October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1231027] New: Remove /srv/www from filesystem package
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231027 Bug ID: 1231027 Summary: Remove /srv/www from filesystem package Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The /srv/www hierarchy is outside of the root subvolume and only used by a few packages, which are not part of MicroOS/SLE Micro. But the directories are part of the filesystem package. This requires some special hacks in the filesystem package and changes to this directories or files added to them are not visible on MicroOS/SL Micro. The /srv/www directories should be moved to the packages which really uses them, like we did already with all other directories in /srv. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1232635] New: VUL-0: CVE-2024-3935: mosquitto: double free and subsequent crash when running under bridge mode and processing remote connections
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232635 Bug ID: 1232635 Summary: VUL-0: CVE-2024-3935: mosquitto: double free and subsequent crash when running under bridge mode and processing remote connections Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426290/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mardnh(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. References: https://mosquitto.org/blog/2024/10/version-2-0-19-released/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3935 https://www.cve.org/CVERecord?id=CVE-2024-3935 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1232636] New: VUL-0: CVE-2024-10525: mosquitto: from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe ...
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232636 Bug ID: 1232636 Summary: VUL-0: CVE-2024-10525: mosquitto: from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe ... Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426289/ OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Security Assignee: mardnh(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-10525 https://www.cve.org/CVERecord?id=CVE-2024-10525 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/190 https://mosquitto.org/blog/2024/10/version-2-0-19-released/ -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1232559] New: VUL-0: CVE-2024-48921: kyverno: kyverno: a kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace, allowing users with privileges to non-kyverno namespaces to create exceptions
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232559 Bug ID: 1232559 Summary: VUL-0: CVE-2024-48921: kyverno: kyverno: a kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace, allowing users with privileges to non-kyverno namespaces to create exceptions Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426194/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: opensuse_buildservice(a)ojkastl.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Depends on: 1232557 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1232557 +++ Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-48921 https://www.cve.org/CVERecord?id=CVE-2024-48921 https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1232557] New: VUL-0: CVE-2024-48921: TRACKERBUG: kyverno: a kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace, allowing users with privileges to non-kyverno namespaces to create exceptions
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232557 Bug ID: 1232557 Summary: VUL-0: CVE-2024-48921: TRACKERBUG: kyverno: a kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace, allowing users with privileges to non-kyverno namespaces to create exceptions Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426194/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-48921 https://www.cve.org/CVERecord?id=CVE-2024-48921 https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1218101] New: qBittorrent blurry fonts on kde wayland
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1218101 Bug ID: 1218101 Summary: qBittorrent blurry fonts on kde wayland Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Usability Assignee: screening-team-bugs(a)suse.de Reporter: piotrus3g(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 871385 --> https://bugzilla.suse.com/attachment.cgi?id=871385&action=edit Compare the fonts in qBittorrent to the right click menu on the app's titlebar Operating System: openSUSE Tumbleweed 20231213 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.112.0 Qt Version: 5.15.11 Kernel Version: 6.6.6-1-default (64-bit) Graphics Platform: Wayland Processors: 12 × AMD Ryzen 5 5625U with Radeon Graphics Memory: 13,5 GiB of RAM Graphics Processor: AMD Radeon Graphics Manufacturer: LENOVO Product Name: 82SG System Version: IdeaPad 5 15ABA7 Issue: qBittorrent fonts are a bit blurry under wayland on kde. Steps to reproduce: Launch qBittorrent and see that the fonts aren't as sharp as other programs. Observed behavior: Fonts are blurrier than other programs. Expected behavior: Fonts are sharp just like every other app. Additional information: I'm not sure if it's related, but right now scaling in kde wayland on tumbleweed is a bit broken, because user has to set scaling by force font dpi and not by display scaling. Scaling works when screen scaling is at 100% and force font dpi is set to apply actual scaling (120dpi in my case for effective 125% scaling). -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1220260] New: qBittorrent freezes after opening and closing preferences
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1220260 Bug ID: 1220260 Summary: qBittorrent freezes after opening and closing preferences Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Maintenance Assignee: screening-team-bugs(a)suse.de Reporter: piotrus3g(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE Tumbleweed 20240221 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.115.0 Qt Version: 5.15.12 Kernel Version: 6.7.5-1-default (64-bit) Graphics Platform: Wayland Processors: 12 × AMD Ryzen 5 5625U with Radeon Graphics Memory: 13,5 GiB of RAM Graphics Processor: AMD Radeon Graphics Manufacturer: LENOVO Product Name: 82SG System Version: IdeaPad 5 15ABA7 Steps to reproduce: 1. Open qbittorrent 2. Open qbittorrent preferences 3. Close preferences window Observed result: qbittorrent freezes. Expected result: qbittorrent doesn't freeze. Additional information: qbittorrent unfreezes after a short time and seems to work properly. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1231832] New: [Build 20241020] openQA test fails in podman_netavark
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231832 Bug ID: 1231832 Summary: [Build 20241020] openQA test fails in podman_netavark Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other URL: https://openqa.opensuse.org/tests/4580879/modules/podm an_netavark/steps/183 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation Error: netavark: unable to append rule '-j MARK --set-xmark 0x2000/0x2000' to table 'nat': code: 2, msg: Warning: Extension MARK revision 0 not supported, missing kernel module? ip6tables v1.8.10 (legacy): unknown option "--set-xmark" Try `ip6tables -h' or 'ip6tables --help' for more information The 'missing kernel module', and the fact that we updated the kernel to 6.11.4 in this snapshot (and I did not see anything podman/netavark related) triggered me to file this bug against Kernel component openQA test in scenario microos-Tumbleweed-DVD-x86_64-container-host@64bit fails in [podman_netavark](https://openqa.opensuse.org/tests/4580879/modules/podman_n… ## Test suite description ## Reproducible Fails since (at least) Build [20241020](https://openqa.opensuse.org/tests/4580329) ## Expected result Last good: [20241018](https://openqa.opensuse.org/tests/4577907) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=microos… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1231825] New: Kernel 6.11.4 bluetooth scan stops working
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231825 Bug ID: 1231825 Summary: Kernel 6.11.4 bluetooth scan stops working Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: novell(a)tower-net.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- With Kernel 6.11.4 from https://build.opensuse.org/project/show/Kernel:stable:Backport the bluetooth scan doesn't find my mouse any longer. Rebooting 6.11.3 I can pair mouse and booting 6.11.4 I can use a pre-connected but no reconnect possible. dmesg | grep -i blue: [ 1.826585] usb 3-3: Product: Bluetooth Radio [ 2.947702] Bluetooth: Core ver 2.22 [ 2.947728] NET: Registered PF_BLUETOOTH protocol family [ 2.947730] Bluetooth: HCI device and connection manager initialized [ 2.947739] Bluetooth: HCI socket layer initialized [ 2.947743] Bluetooth: L2CAP socket layer initialized [ 2.947748] Bluetooth: SCO socket layer initialized [ 3.118618] Bluetooth: hci0: RTL: examining hci_ver=0b hci_rev=000b lmp_ver=0b lmp_subver=8852 [ 3.120636] Bluetooth: hci0: RTL: rom_version status=0 version=1 [ 3.120645] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_fw.bin [ 3.126553] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_config.bin [ 3.128658] Bluetooth: hci0: RTL: cfg_sz 6, total sz 65603 [ 3.192619] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 3.192622] Bluetooth: BNEP filters: protocol multicast [ 3.192628] Bluetooth: BNEP socket layer initialized [ 3.711634] Bluetooth: hci0: RTL: fw version 0x04479301 [ 3.840057] Bluetooth: hci0: AOSP extensions version v1.00 [ 3.840061] Bluetooth: hci0: AOSP quality report is supported [ 4.081505] Bluetooth: MGMT ver 1.23 [ 15.909955] Bluetooth: hci0: AOSP extensions version v1.00 [ 15.909971] Bluetooth: hci0: AOSP quality report is supported [ 17.644507] input: Lenovo Bluetooth Mouse as /devices/virtual/misc/uhid/0005:17EF:60EF.0002/input/input19 [ 17.644841] input: Lenovo Bluetooth Mouse Keyboard as /devices/virtual/misc/uhid/0005:17EF:60EF.0002/input/input20 [ 17.645123] input: Lenovo Bluetooth Mouse as /devices/virtual/misc/uhid/0005:17EF:60EF.0002/input/input21 [ 17.645391] hid-generic 0005:17EF:60EF.0002: input,hidraw1: BLUETOOTH HID v0.15 Mouse [Lenovo Bluetooth Mouse] on f4:6a:dd:7d:17:10 [ 131.404331] input: Lenovo Bluetooth Mouse as /devices/virtual/misc/uhid/0005:17EF:60EF.0003/input/input22 [ 131.405030] input: Lenovo Bluetooth Mouse Keyboard as /devices/virtual/misc/uhid/0005:17EF:60EF.0003/input/input23 [ 131.405255] input: Lenovo Bluetooth Mouse as /devices/virtual/misc/uhid/0005:17EF:60EF.0003/input/input24 [ 131.405436] hid-generic 0005:17EF:60EF.0003: input,hidraw1: BLUETOOTH HID v0.15 Mouse [Lenovo Bluetooth Mouse] on f4:6a:dd:7d:17:10 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1212947] New: Disable fbdev userspace interfaces and programs
by bugzilla_noreply＠suse.com 04 Nov '24

04 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1212947 Bug ID: 1212947 Summary: Disable fbdev userspace interfaces and programs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: tzimmermann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- We want to remove fbdev from kernel and userspace as far as possible. Linux 6.6 will allow us to disable fbdev's userspace interfaces, most noteably /dev/fb*. Enable this feature in the TW kernel. Framebuffer support has been an endless source of bugs. Not giving userspace access to it's internals and framebuffer memory will close a possible entry point for all sorts of malware. Please note that the framebuffer console is implemented entirely within the kernel and will not be affected by this change. -- You are receiving this mail because: You are on the CC list for the bug.

1 6