October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1229913] New: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229913 Bug ID: 1229913 Summary: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: popov895(a)ukr.net Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1205607 We've been asked to have a fresh look ad kio-admin, formerly rejected in bug 1205607. AFAIK upstream activities to come up with a robust API have been abandoned, but we can still have another look at the current production code. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1232527] New: [SELinux] "systemd-bless-boot good" fail during boot time
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232527 Bug ID: 1232527 Summary: [SELinux] "systemd-bless-boot good" fail during boot time Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: danilo.spinella(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE MicroOS SELinux status, mode and policy name: enabled, enforcing, targeted SELinux policy version and repository: 20241021-1.1, openSUSE-Tumbleweed-Oss The software (incl. version) that is affected by the SELinux issue and the error message: systemd 256.7, systemd-bless-boot, "Failed to rename '/loader/entries/opensuse-microos-6.11.5-1-default-1+2-1.conf' to '/loader/entries/opensuse-microos-6.11.5-1-default-1.conf': Permission Denied" SELinux Audit log: type=AVC msg=audit(1730195064.486:34): avc: denied { rename } for pid=1142 comm="systemd-bless-b" name="opensuse-microos-6.11.5-1-default-1+2-1.conf" dev="vda2" ino=11 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=0 Any other important details: N/A -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1229813] New: dbus.socket does not start dbus-broker.service
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229813 Bug ID: 1229813 Summary: dbus.socket does not start dbus-broker.service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Services which require dbus have a dependency on dbus.socket in their service file. dbus-broker has no dbus.service file, thus this dependencies are broken and a boot only succeeds by pure luck. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1226207] New: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226207 Bug ID: 1226207 Summary: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- kf6-breeze-icons generate identical icons for both breeze & breeze-dark. While this is not an issue for KF6 apps, that use run-time recoloring, in KF5 apps, like Krusader, when dark color theme is used and icons are breeze-dark symbolic icons are dark on dark background and almost invisible. The reason is this build option: `-DWITH_ICON_GENERATION:BOOL=FALSE` I've tried to make my custom build [1] switching it to TRUE and breeze-dark icons are fine with Krusader now. But I don't know the reasoning behind switching it to FALSE. There is comment: ``` saves ~30MB and installs dangling symlinks ``` Less size is true, though IMHO it's not a good solution to break KF5 apps to save some space. But I can't see any dangling symlinks: ``` find /usr/share/icons/breeze{,-dark} -xtype l ``` doesn't find anything. Any other reason or should I cleanup [1] and make a submit request? [1] https://build.opensuse.org/package/show/home:NickLion:branches:KDE:Framewor… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1231408] New: VUL-0: CVE-2024-25885: python-xhtml2pdf: regular expression denial of service through the getcolor function in utils.py
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1231408 Bug ID: 1231408 Summary: VUL-0: CVE-2024-25885: python-xhtml2pdf: regular expression denial of service through the getcolor function in utils.py Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/423265/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-25885 https://www.cve.org/CVERecord?id=CVE-2024-25885 http://dirk.com http://xhtml2pdf.com https://gist.github.com/salvatore-abello/c88dd0027496774023ef36c7b576d206 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1228868] New: Incorrect count of requests in `call_count`
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1228868 Bug ID: 1228868 Summary: Incorrect count of requests in `call_count` Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: ahasenkopf(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876481 --> https://bugzilla.suse.com/attachment.cgi?id=876481&action=edit Small script to reproduce the bug The `call_count` attribute of mocks differs from upstream packages. When using `urllib3.Retry` and using `responses` to mock a request, the resulting call count is wrong. With the attached example script, all Python versions and upstream packages from PyPI result in a call count of 7. On Leap 15.5 and Leap 15.6 the value is 11. Installed RPMs (excerpt): * python3-base-3.6.15-150300.10.65.1.x86_64 * libpython3_6m1_0-3.6.15-150300.10.65.1.x86_64 * python3-3.6.15-150300.10.65.2.x86_64 * python3-urllib3-1.25.10-150300.4.9.1.noarch * python3-requests-2.25.1-150300.3.6.1.noarch * python3-responses-0.21.0-150300.3.3.1.noarch Steps to reproduce: ``` docker run -it --rm registry.opensuse.org/opensuse/leap:15.6 zypper in python3-responses python3 <path-to-example-script> ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1229551] New: django-webtest: Enable sle15_python_module_pythons
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229551 Bug ID: 1229551 Summary: django-webtest: Enable sle15_python_module_pythons Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: egotthold(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- My application (Orthos 2) cannot be installed on Leap since it requires django-webtest, which is unavailable with Python 3.11. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1231578] New: Dell Latitude laptop kernel panic during wake up after suspend to disk since kernel-default updates
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1231578 Bug ID: 1231578 Summary: Dell Latitude laptop kernel panic during wake up after suspend to disk since kernel-default updates Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: opensuse.lietuviu.kalba(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 877933 --> https://bugzilla.suse.com/attachment.cgi?id=877933&action=edit grep "kernel-default" /var/log/zypp/history I used openSUSE Leap 15.5 in Dell Latitude laptop having: - 4 × Intel® Core™ i5-4300M CPU @ 2.60GHz - Mesa Intel® HD Graphics 4600 I used it with 5.14.21-150500.55.73.1 from 2024-08-16 till 2024-10-01 without suspend to disk problems. But since update to kernel-default|5.14.21-150500.55.80.2 on 2024-10-01, computer hang during wake-up from suspend to disk. Symptoms: - black screen, - keyboard and mouse does not respond, - no disk activity, - after several seconds CAPS Lock starts blinking; - SySRq keys (REISUB) does not work. If I press Ctrl+Alt+F2 (to switch from graphical session to TTY) right after pressing button in KDE desktop to suspend to disk, computer during wake-up shows this TTY, but also have same symptoms: no cursor is blinking, keyboard does not respond, after several seconds CAPS Lock starts blinking... P.S. In past (with older openSUSE 15.4) I had similar problems, but only if I wake-up computer disconnected from power (i.e. using battery only) and it just hanged at moment of entering into graphical session (if I wake up in TTY - it not hanged, by hanged immediately at pressing Ctrl+Alt+F7). Thus in past it seemed related to graphical card drivers, but not now. -- You are receiving this mail because: You are on the CC list for the bug.

1 18