October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1223697] New: VUL-0: CVE-2023-26793: libmodbus: heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.
by bugzilla_noreply＠suse.com 09 Dec '24

09 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1223697 Bug ID: 1223697 Summary: VUL-0: CVE-2023-26793: libmodbus: heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/403923/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26793 https://www.cve.org/CVERecord?id=CVE-2023-26793 https://github.com/stephane/libmodbus/issues/683 -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1224062] New: VUL-0: CVE-2024-34244: libmodbus: buffer overflow via the modbus_write_bits function
by bugzilla_noreply＠suse.com 08 Dec '24

08 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1224062 Bug ID: 1224062 Summary: VUL-0: CVE-2024-34244: libmodbus: buffer overflow via the modbus_write_bits function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/404865/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially crafted input, which leads to out-of-bounds read and can potentially cause a crash or other unintended behaviors. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34244 https://www.cve.org/CVERecord?id=CVE-2024-34244 https://github.com/stephane/libmodbus/issues/743 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1226986] New: Valkey migration enables bogus valkey@basename services
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226986 Bug ID: 1226986 Summary: Valkey migration enables bogus valkey@basename services Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: georg.pfuetzenreuter(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I never had a "redis@basename" instance! Yet after todays dup to 20240624 which replaced redis with valkey-7.2.5-2.1.x86_64 the migration logic enabled these bogus services, which naturally failed during boot: ``` ~> ll /etc/systemd/system/multi-user.target.wants/valkey* lrwxrwxrwx 1 root root 39 Jun 26 08:10 '/etc/systemd/system/multi-user.target.wants/valkey(a)basename.service' -> '/usr/lib/systemd/system/valkey@.service' lrwxrwxrwx 1 root root 48 Jun 26 08:10 '/etc/systemd/system/multi-user.target.wants/valkey-sentinel(a)basename.service' -> '/usr/lib/systemd/system/valkey-sentinel@.service' ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1227527] New: Failed to start Valkey Sentinel instance: basename
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1227527 Bug ID: 1227527 Summary: Failed to start Valkey Sentinel instance: basename Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- after update of Tumbleweed, I suddenly see following error: Starting libvirt QEMU daemon... [ OK ] Finished Permit User Sessions. Starting X Display Manager... Starting Hold until boot process finishes up... [FAILED] Failed to start Valkey Sentinel instance: basename. See 'systemctl status valkey-sentinel(a)basename.service' for details. [FAILED] Failed to start Valkey instance: basename. See 'systemctl status valkey(a)basename.service' for details. Starting Valkey Sentinel instance: basename... Starting Valkey instance: basename... [FAILED] Failed to start Valkey Sentinel instance: basename. See 'systemctl status valkey-sentinel(a)basename.service' for details. [FAILED] Failed to start Valkey instance: basename. See 'systemctl status valkey(a)basename.service' for details. [ OK ] Started NTP client/server. [ OK ] Reached target System Time Synchronized. [ OK ] Started Backup of RPM database. [ OK ] Started Backup of /etc/sysconfig. [ OK ] Started Balance block groups on a btrfs filesystem. [ OK ] Started Scrub btrfs filesystem, verify block checksums. [ OK ] Started Check if mainboard battery is Ok. [ OK ] Started Discard unused filesystem blocks once a week. [ OK ] Started Daily rotation of log files. [ OK ] Started Daily man-db regeneration. [ OK ] Started Timeline of Snapper Snapshots. [ OK ] Started daily update of the root trust anchor for DNSSEC. [ OK ] Reached target Timer Units. [ OK ] Started Command Scheduler. Starting Valkey Sentinel instance: basename... Starting Valkey instance: basename... [ OK ] Started OpenSSH Daemon.zaoliang@dell-5320:/var/log> systemctl status valkey-sentinel(a)basename.service × valkey-sentinel(a)basename.service - Valkey Sentinel instance: basename Loaded: loaded (/usr/lib/systemd/system/valkey-sentinel@.service; enabled; preset: disabled) Active: failed (Result: exit-code) since Mon 2024-07-08 18:53:01 CEST; 1min 13s ago Process: 1449 ExecStart=/usr/bin/valkey-sentinel /etc/valkey/sentinel-basename.conf (code=exited, status=1/FAILURE) Main PID: 1449 (code=exited, status=1/FAILURE) CPU: 50ms Warning: some journal files were not opened due to insufficient permissions. zaoliang@dell-5320:/var/log> sudo systemctl status valkey-sentinel(a)basename.service × valkey-sentinel(a)basename.service - Valkey Sentinel instance: basename Loaded: loaded (/usr/lib/systemd/system/valkey-sentinel@.service; enabled; preset: disabled) Active: failed (Result: exit-code) since Mon 2024-07-08 18:53:01 CEST; 1min 32s ago Process: 1449 ExecStart=/usr/bin/valkey-sentinel /etc/valkey/sentinel-basename.conf (code=exited, status=1/FAILURE) Main PID: 1449 (code=exited, status=1/FAILURE) CPU: 50ms Jul 08 18:53:01 dell-5320 systemd[1]: valkey-sentinel(a)basename.service: Scheduled restart job, restart counter is at 5. Jul 08 18:53:01 dell-5320 systemd[1]: valkey-sentinel(a)basename.service: Start request repeated too quickly. Jul 08 18:53:01 dell-5320 systemd[1]: valkey-sentinel(a)basename.service: Failed with result 'exit-code'. Jul 08 18:53:01 dell-5320 systemd[1]: Failed to start Valkey Sentinel instance: basename. zaoliang@dell-5320:/var/log> sudo systemctl restart valkey-sentinel(a)basename.service Job for valkey-sentinel(a)basename.service failed because the control process exited with error code. See "systemctl status valkey-sentinel(a)basename.service" and "journalctl -xeu valkey-sentinel(a)basename.service" for details. [FAILED] Failed to start Valkey Sentinel instance: basename. -- zaoliang@dell-5320:/var/log> cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20240704" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20240704" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" # CPE 2.3 format, boo#1217921 CPE_NAME="cpe:2.3:o:opensuse:tumbleweed:20240704:*:*:*:*:*:*:*" #CPE 2.2 format #CPE_NAME="cpe:/o:opensuse:tumbleweed:20240704" BUG_REPORT_URL="https://bugzilla.opensuse.org" SUPPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1225965] New: Improve KDE Discover bug reporting button
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1225965 Bug ID: 1225965 Summary: Improve KDE Discover bug reporting button Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: shundhammer(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Whenever we have a generic package issues that affects multiple users like (bug 1225174), we get a whole to of bug reports and duplicates. All that users seem to be doing is copy the text "<html>Dependency resolution failed:<br/><br/>[...] </html>", report a bug in a random component. Bonus: If the component is YaST, Huha gets angry like in bug 1225949. We do not see the bugs that were not reported due to bugzilla pointing out the possible duplicate, but in the example above we got 14 reports. These users may or may not have read through the duplicated bug, or read the recommendation there. https://github.com/KDE/discover/blob/d644b2a1000c04f084d39a4ef8a3402abf6417… Let's improve user experience here. Some ideas: 0. Direct the user to zypper/YaST for self-service resolution of the conflict. 1. Direct the user to a landing page with instructions for #0. 2. Direct the user to bugzilla search first 3. Take the message - extract package names only, strip arch/installed version, sort, and make a hash from it. Use that as the bug alias for automatic reduplication. 4. or even a fuzzy hash 5. Use a bugzilla whiteboard field with self-service fix instructions -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1227364] New: trackerbug: packages build differently without %check
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1227364 Bug ID: 1227364 Summary: trackerbug: packages build differently without %check Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bwiedemann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1081754 Target Milestone: --- Found By: Development Blocker: --- The %check section in a .spec file runs scripts that may modify the package output. Some packages fail to build with osc build --nocheck and some others produce different build results. Both of these cases make reproducible-builds harder and are considered bugs. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226101] New: Joystick and steering wheel not found in system settings
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226101 Bug ID: 1226101 Summary: Joystick and steering wheel not found in system settings Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: Michael.Zapf(a)mizapf.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The Plasma System Settings do not show any game controllers, although there is a digital joystick (connected via a Hexagons USB adapter) and a Logitech G25 steering wheel connected. It only shows a XBox game controller when plugged it. The settings were present for the Joystick and the steering wheel in some earlier release (unknown). The devices are found by the system (as dmesg states) and are usable in games, but cannot be configured in KDE. Contrary to the advice in the help file, there is no way to add a non-detected device in the settings. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1232328] New: [SELinux] kanidm still uses /usr/sbin paths in file context
by bugzilla_noreply＠suse.com 06 Dec '24

06 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232328 Bug ID: 1232328 Summary: [SELinux] kanidm still uses /usr/sbin paths in file context Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: filippo.bonazzi(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The kanidm_unixd.fc file still contains several paths under /usr/sbin instead of /usr/bin -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1232647] New: AUDIT-WHITELIST: sddm-kalpa whitelist of dbus configuration file
by bugzilla_noreply＠suse.com 06 Dec '24

06 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232647 Bug ID: 1232647 Summary: AUDIT-WHITELIST: sddm-kalpa whitelist of dbus configuration file Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: sfalken(a)cloverleaf-linux.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Can I please get a review, and a whitelist, based on the following: [ 97s] sddm-kalpa.x86_64: E: dbus-file-unauthorized (Badness: 10) /usr/share/dbus-1/system.d/org.freedesktop.DisplayManager-sddm.conf (sha256 file digest default filter:daa7d493ab968d706530339465449d98e09a5f717c230b85bf0f0e3d1365de2c shell filter:b3416d1bd9f087c9be887c1610296a116cb16a5f04e81fc0d61275ccbbc99842 xml filter:4b4cbecadaf6124b64d65abcc27157a154f4f3544b1a68b1f0754282e6766c8f) [ 97s] Packaging D-Bus services requires a review and whitelisting by the SUSE [ 97s] security team. If the package is intended for inclusion in any SUSE product [ 97s] please open a bug report to request review of the package by the security [ 97s] team. Please refer to [ 97s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 97s] more information. Package is https://build.opensuse.org/package/show/devel:microos:kalpa/sddm-kalpa -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1229724] New: Wireshark connections started at login - even without network
by bugzilla_noreply＠suse.com 06 Dec '24

06 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229724 Bug ID: 1229724 Summary: Wireshark connections started at login - even without network Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: axel.braun(a)gmx.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I have a wireshark VPN configured. After login the wireshark connection gets activated, even without having a network connection established (kwallet asks for the password). wireshark has the flag 'connect automatically with priority' set (I guess a default setting), but a) I dont really know what it does and b) it does not make sense to connect if the wifi connection is not established. I reported this to the KDE bugtracker as well: https://bugs.kde.org/show_bug.cgi?id=484542 but I guess its not a KDE, more a NM problem Operating System: openSUSE Tumbleweed 20240823 KDE Plasma Version: 6.1.4 KDE Frameworks Version: 6.5.0 Qt Version: 6.7.2 Kernel Version: 6.10.5-1-default (64-bit) Graphics Platform: X11 -- You are receiving this mail because: You are on the CC list for the bug.

1 1