October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1232681] New: VUL-0: CVE-2024-21537: python-pydata-sphinx-theme: lilconfig: insecure usage of eval in the dynamicImport function
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232681 Bug ID: 1232681 Summary: VUL-0: CVE-2024-21537: python-pydata-sphinx-theme: lilconfig: insecure usage of eval in the dynamicImport function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426383/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, python-maintainers(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Depends on: 1232672 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1232672 +++ Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21537 https://www.cve.org/CVERecord?id=CVE-2024-21537 https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39… https://github.com/antonk52/lilconfig/pull/48 https://github.com/antonk52/lilconfig/releases/tag/v3.1.1 https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1232679] New: VUL-0: CVE-2024-21537: xpra-html5: lilconfig: insecure usage of eval in the dynamicImport function
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232679 Bug ID: 1232679 Summary: VUL-0: CVE-2024-21537: xpra-html5: lilconfig: insecure usage of eval in the dynamicImport function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426383/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, scott.bradnick(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1232672 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1232672 +++ Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21537 https://www.cve.org/CVERecord?id=CVE-2024-21537 https://github.com/antonk52/lilconfig/commit/2c68a1ab8764fc74acc46771e1ad39… https://github.com/antonk52/lilconfig/pull/48 https://github.com/antonk52/lilconfig/releases/tag/v3.1.1 https://security.snyk.io/vuln/SNYK-JS-LILCONFIG-6263789 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c13 --- Comment #13 from Michael Hirmke <opensuse(a)mike.franken.de> --- So when will AusweisApp be usable again? I urgently need to access my Justizpostfach authenticating via BundID, Ausweisapp and my passport! Using my smartphone as a cardreader is not possible, because I have to go through a wireguard vpn to access my network from the smartphone. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231381] AUDIT-WHITELIST: libcgroup: permissions.d drop-in snippet, pam-file-unauthorize, non-standard-gid /usr/bin/cgexec cgred
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231381 https://bugzilla.suse.com/show_bug.cgi?id=1231381#c9 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #9 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- The whitelisting is in Factory now, closing this bug as FIXED. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232647] AUDIT-0: sddm-kalpa: dbus-file-unauthorized: org.freedesktop.DisplayManager-sddm.conf
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232647 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|AUDIT-WHITELIST: sddm-kalpa |AUDIT-0: sddm-kalpa: |whitelist of dbus |dbus-file-unauthorized: |configuration file |org.freedesktop.DisplayMana | |ger-sddm.conf -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221250] New: glibc-locale-base missing locale() provides
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1221250 Bug ID: 1221250 Summary: glibc-locale-base missing locale() provides Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: georg.pfuetzenreuter(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi, the glibc-locale package ships with "Provide"s for the different locales it ships: ``` $ rpm -q --provides glibc-locale|head glibc-locale = 2.38-6.1 glibc-locale(x86-64) = 2.38-6.1 locale(glibc:aa_DJ) locale(glibc:aa_DJ.utf8) locale(glibc:aa_ER) locale(glibc:aa_ER@saaho) locale(glibc:aa_ET) locale(glibc:af_ZA) locale(glibc:af_ZA.utf8) locale(glibc:agr_PE) ``` There are two locales which are shipped in glibc-locale-base - en_US.utf8 and C.utf8. Upon packaging something which requires one of them, I noticed that glibc-locale-base is not shipping any `locale()` "Provide"s. ``` $ rpm -q --provides glibc-locale-base glibc-locale-base = 2.38-6.1 glibc-locale-base(x86-64) = 2.38-6.1 libCNS.so()(64bit) libGB.so()(64bit) libISOIR165.so()(64bit) libJIS.so()(64bit) libJISX0213.so()(64bit) libKSC.so()(64bit) ``` I would expect glibc-locale-base to Provide `locale(glibc:C.utf8)` and `locale(glibc:en_US.utf8)` - both to have providers for all locales in the distribution and to make packaging easier. Unfortunately I could not figure out how the "Provide"s in glibc.spec are generated myself, hence I am opening this report instead. Cheers, Georg -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232650] Lenovo Yoga Pro 7 14ASP9 fails to wake up from suspend mode
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232650 https://bugzilla.suse.com/show_bug.cgi?id=1232650#c1 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |2835365572zty(a)gmail.com, | |tiwai(a)suse.com Flags| |needinfo?(2835365572zty@gma | |il.com) --- Comment #1 from Takashi Iwai <tiwai(a)suse.com> --- Could you check with the latest 6.12-rc kernel in OBS Kernel:HEAD repo? http://download.opensuse.org/repositories/Kernel:/HEAD/standard/ If the problem still happens with that, we'd like to know whether it's a regression. You can try the older TW kernels from my repos, e.g. OBS home:tiwai:kernel:6.10, home:tiwai:kernel:6.9, etc: http://download.opensuse.org/repositories/home:/tiwai:/kernel:/6.10/standar… http://download.opensuse.org/repositories/home:/tiwai:/kernel:/6.9/standard/ -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232568] arm-none-eabi tools are broken
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232568 https://bugzilla.suse.com/show_bug.cgi?id=1232568#c3 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |INVALID Flags|needinfo?(aaron.w2(a)gmail.co | |m) | --- Comment #3 from Stefan Hundhammer <shundhammer(a)suse.com> --- The only one that I can find on https://software.opensuse.org/ is this: https://software.opensuse.org/package/cross-arm-none-eabi-gcc at home:duwe:crosstools2 (i.e. a developer's home project - no support) for Leap 15.6 and gcc-14. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232647] AUDIT-WHITELIST: sddm-kalpa whitelist of dbus configuration file
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232647 https://bugzilla.suse.com/show_bug.cgi?id=1232647#c1 --- Comment #1 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- Thank your for opening the AUDIT bug. We will check the package and report back. It could take a bit due to other tasks in the queue. Short summary: sddm-kalpa is a Wayland-only version of sddm. So the D-Bus service is likely similar to what we already have in sddm. The config file is renamed in the spec file to carry the -sddm.conf suffix to prevent a conflict with the traditional sddm package. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232658] New: test
by bugzilla_noreply＠suse.com 31 Oct '24

31 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232658 Bug ID: 1232658 Summary: test Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: roivipoicramu-4598(a)yopmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- test -- You are receiving this mail because: You are on the CC list for the bug.

1 1