October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1222479] New: VUL-0: CVE-2024-22189: kubo: quic-go: memory exhaustion attack against QUIC's connection ID mechanism
by bugzilla_noreply＠suse.com 03 Feb '25

03 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1222479 Bug ID: 1222479 Summary: VUL-0: CVE-2024-22189: kubo: quic-go: memory exhaustion attack against QUIC's connection ID mechanism Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/400376/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: bwiedemann(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: qa-bugs(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1222461 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1222461 +++ quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22189 https://www.cve.org/CVERecord?id=CVE-2024-22189 https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c… https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478 https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-manageme… https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683s https://bugzilla.redhat.com/show_bug.cgi?id=2273513 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1217820] New: spdlog on aarch64 and armv{6,7} needs rebuilt against libfmt10
by bugzilla_noreply＠suse.com 03 Feb '25

03 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1217820 Bug ID: 1217820 Summary: spdlog on aarch64 and armv{6,7} needs rebuilt against libfmt10 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: brunopitrus(a)hotmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Right now spdlog-devel is broken on the ARM ports as it pulls in fmt 10 headers while the library itself exports fmt 9 types. (I do not have an arm machine and only noticed this because vscode fails to build) What's worse, spdlog exports fmt types as part of its ABI which in particular means that it breaks abi without soname bump whenever fmt breaks abi. This would be less of a problem if fmt-9 were simply dropped from the distro (due to broken deps triggering a rebuild), but as it still exists, every spdlog consumer must also be manually rebuilt. -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1229650] New: openssh 9.8p1 issues
by bugzilla_noreply＠suse.com 03 Feb '25

03 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1229650 Bug ID: 1229650 Summary: openssh 9.8p1 issues Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- openssh 9.8p1 was accepted in Factory yesterday (SR#1194679). While in Staging, a small update in the staging openQA was required https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/20010) but sadly, after accepting the package in Factory, some of the openQA test to move from Factory to Tumbleweed failed. In these tests sshd / sshd-session seem to have issues with selinux: * https://openqa.opensuse.org/tests/4422288#step/crypto_policies_tests/45 (Failed to start OpenSSH Daemon) * https://openqa.opensuse.org/tests/4422289#step/aulast/27 (security audit test fails) There is also another one in microos test "journal_check" where I'm not so sure about selinux involvement: https://openqa.opensuse.org/tests/4422252#step/journal_check/20 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1219879] New: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0
by bugzilla_noreply＠suse.com 03 Feb '25

03 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1219879 Bug ID: 1219879 Summary: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: otto.hollmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This bug collects the challenges and packages that need to be adapted before removing OpenSSL 1.1.1 and OpenSSL 1.0.0 OpenSSL 1.1.1 (package openssl1_1) is EOL since 11th September 2023. OpenSSL 1.0.0 (package openssl1_0_0) is EOL since 31th December 2019. Therefore, it makes sense to get rid of them and we are going to remove them from Factory in the near future. Unfortunately some packages still rely/depend on these old OpenSSL versions. If we would like to keep these packages, they must be adapted to use OpenSSL 3. Currently these packages are usually hardcoded to use specific openssl package, e.g.: > BuildRequires: libopenssl-1_1-devel The preferred way is to use our meta package > BuildRequires: libopenssl or > BuildRequires: libopenssl-devel that will always pull respective packages with the default OpenSSL version (at the moment libopenssl3 or libopenssl-3-devel). Migration guide can be found here: https://www.openssl.org/docs/man3.0/man7/migration_guide.html List of packages that are using old OpenSSL: dd_rescue EternalTerminal fdo-client libredfish libzrtpcpp python -- You are receiving this mail because: You are on the CC list for the bug.

1 26

[Bug 1218653] New: Gimp 3 scheduled for May - Lets start the preparations
by bugzilla_noreply＠suse.com 03 Feb '25

03 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1218653 Bug ID: 1218653 Summary: Gimp 3 scheduled for May - Lets start the preparations Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- - https://www.phoronix.com/news/GIMP-3.0-May-2024-Schedule - https://librearts.org/2023/11/gimp-3-0-roadmap/ current test packages are in: https://build.opensuse.org/project/show/graphics:gimp:master i dropped a mail to Jehan to find out if the master snapshots of gegl and babl are still needed or not. if we want to have parallel buildable packages it would be easy to rename the master gimp package to gimp3 and apply this patch: ``` Index: gimp.spec =================================================================== --- gimp.spec (revision 1878) +++ gimp.spec (working copy) @@ -67,14 +67,16 @@ %global abiver 5 %global apiver 3.0 -Name: gimp +%define pkg_name gimp + +Name: gimp3 Version: 3.0 Release: 0 Summary: The GNU Image Manipulation Program License: GPL-3.0-or-later Group: Productivity/Graphics/Bitmap Editors URL: https://www.gimp.org/ -Source: %{name}-%{version}.tar.zst +Source: %{pkg_name}-%{version}.tar.zst Source1: macros.gimp # openSUSE palette file Source2: openSUSE.gpl @@ -184,6 +186,7 @@ Provides: gimp-2.0 = %{version} Provides: gimp(abi) = %{abiver} Provides: gimp(api) = %{apiver} +Conflicts: gimp %description The GIMP is an image composition and editing program, which can be @@ -296,7 +299,7 @@ %endif %prep -%autosetup -p1 +%autosetup -p1 -n %{pkg_name}-%{version} %build #define _lto_cflags %{nil} ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 32

[Bug 1222938] New: thunar-plugin-vcs fails to build on Leap 15.6
by bugzilla_noreply＠suse.com 31 Jan '25

31 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1222938 Bug ID: 1222938 Summary: thunar-plugin-vcs fails to build on Leap 15.6 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello package thunar-plugin-vcs fails to build on Leap 15.6 https://build.opensuse.org/package/live_build_log/openSUSE:Backports:SLE-15… [ 40s] /usr/lib64/gcc/x86_64-suse-linux/7/../../../../x86_64-suse-linux/bin/ld: /usr/lib64/libserf-1.so.1: undefined reference to `ERR_GET_FUNC' [ 40s] collect2: error: ld returned 1 exit status [ 40s] make[2]: *** [Makefile:620: tvp-svn-helper] Error 1 [ 40s] make[2]: Leaving directory '/home/abuild/rpmbuild/BUILD/thunar-vcs-plugin-0.2.0/tvp-svn-helper' [ 40s] make[1]: *** [Makefile:486: all-recursive] Error 1 [ 40s] make[1]: Leaving directory '/home/abuild/rpmbuild/BUILD/thunar-vcs-plugin-0.2.0' [ 40s] make: *** [Makefile:418: all] Error 2 [ 40s] error: Bad exit status from /var/tmp/rpm-tmp.ozgrvm (%build) [ 40s] [ 40s] Could you please have a look? We're at RC code submission deadline so the sooner the better. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1221211] New: /usr/lib64/libserf-1.so.1: undefined reference to `ERR_GET_FUNC'
by bugzilla_noreply＠suse.com 31 Jan '25

31 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1221211 Bug ID: 1221211 Summary: /usr/lib64/libserf-1.so.1: undefined reference to `ERR_GET_FUNC' Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: manfred.h(a)gmx.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Package libserf BuildRequires libopenssl-devel, but libopenssl-devel-3.* in Leap 15.6 no longer provides the symbol `ERR_GET_FUNC'. We either need an updated version of libserf, or libopenssl-devel < 3! -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1225688] New: [tw] [hexchat] gnome-shell The program 'hexchat' received an X Window System error when connecting to netwok
by bugzilla_noreply＠suse.com 31 Jan '25

31 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1225688 Bug ID: 1225688 Summary: [tw] [hexchat] gnome-shell The program 'hexchat' received an X Window System error when connecting to netwok Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 URL: https://openqa.opensuse.org/tests/4236088/modules/hexc hat/steps/28 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: richard.fan(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Description The issue is a sporadic one, but I can see the issue several times in openQA automation tests. it can be seen on both x86_64 and aarch64 platforms. Steps to reproduce the issue: 1. Upgrade the system from leap15.x to tw 2. start hexchat 3. config a nickname and connect to "Libera.Chat" Error logs like below: >May 30 09:49:37.300575 susetest gnome-shell[30709]: The program 'hexchat' received an X Window System error. >May 30 09:49:37.300575 susetest gnome-shell[30709]: This probably reflects a bug in the program. >May 30 09:49:37.307179 susetest gnome-shell[30709]: The error was 'BadWindow (invalid Window parameter)'. >May 30 09:49:37.307179 susetest gnome-shell[30709]: (Details: serial 6056 error_code 3 request_code 38 minor_code 0) >May 30 09:49:37.307179 susetest gnome-shell[30709]: (Note to programmers: normally, X errors are reported asynchronously; >May 30 09:49:37.307179 susetest gnome-shell[30709]: that is, you will receive the error a while after causing it. >May 30 09:49:37.307179 susetest gnome-shell[30709]: To debug your program, run it with the --sync command line >May 30 09:49:37.307179 susetest gnome-shell[30709]: option to change this behavior. You can then get a meaningful >May 30 09:49:37.307179 susetest gnome-shell[30709]: backtrace from your debugger if you break on the gdk_x_error() function.) Please refer to the attached log for more information. ## openQA Observation as below: openQA test in scenario opensuse-Tumbleweed-NET-aarch64-zdup-Leap-15.5-gnome@aarch64 fails in [hexchat](https://openqa.opensuse.org/tests/4236088/modules/hexchat/steps/28) ## Test suite description Maintained by qe-core ## Reproducible Fails since (at least) Build [20240529](https://openqa.opensuse.org/tests/4235968) ## Expected result Last good: (unknown) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=aarch64&distri=opensu… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1231548] New: rusty_v8: packages .o files
by bugzilla_noreply＠suse.com 31 Jan '25

31 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1231548 Bug ID: 1231548 Summary: rusty_v8: packages .o files Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: aavindraa(a)gmail.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: amajer(a)suse.com Blocks: 1062303 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our rusty_v8 package contains files that it probably should not. These have varying names (probably from LTO) such as /usr/lib64/crates/rusty_v8/false/build_script_build-0knbljou9qk3j/s-h0nd8jyxiz-07i8ehl-b7257ohw54kiru274s258lfjp/019rsrysgg6rpjdf91ex4lbvj.o The 'false' in the path makes me think that someone tried to disable it, but failed. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1230373] New: No USB Support after booting on a VisionFive2 8GB system.
by bugzilla_noreply＠suse.com 31 Jan '25

31 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1230373 Bug ID: 1230373 Summary: No USB Support after booting on a VisionFive2 8GB system. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: RISC-V OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: malcolmlewis(a)linuxmail.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Build Identifier: USB devices present in u-boot, not visible after booting Tumbleweed. It seems this patch set should fix the issue; riscv: jh7110: Fix configuration for on-chip USB 2.0 support; <https://lore.kernel.org/all/20240815-endless-credible-324438d164f4@spud/T/> Can this be backported to the current kernel? Reproducible: Always Steps to Reproduce: Using the latest Tumbleweed RISC-V image or the one from Factory, attaching a USB device and booting device is not present. Actual Results: Booting from minicom and checking with u-boot, device is present; ```bash U-Boot SPL 2024.07 (Sep 04 2024 - 13:57:12 +0000) DDR version: dc2e84f0. Trying to boot from MMC2 U-Boot 2024.07 (Sep 04 2024 - 13:57:12 +0000) CPU: sifive,u74-mc Model: StarFive VisionFive 2 v1.3B DRAM: 8 GiB Core: 136 devices, 26 uclasses, devicetree: board WDT: Not starting watchdog@13070000 MMC: mmc@16010000: 0, mmc@16020000: 1 Loading Environment from SPIFlash... SF: Detected gd25lq128 with page size 256 Bytes, erase size 4 KiB, total 16 MiB OK StarFive EEPROM format v2 --------EEPROM INFO-------- Vendor : StarFive Technology Co., Ltd. Product full SN: VF7110B1-2253-D008E000-00003370 data version: 0x2 PCB revision: 0xb2 BOM revision: A Ethernet MAC0 address: 6c:cf:39:00:3d:b0 Ethernet MAC1 address: 6c:cf:39:00:3d:b1 --------EEPROM INFO-------- starfive_7110_pcie pcie@2b000000: Starfive PCIe bus probed. starfive_7110_pcie pcie@2c000000: Starfive PCIe bus probed. In: serial@10000000 Out: serial@10000000 Err: serial@10000000 Net: eth0: ethernet@16030000, eth1: ethernet@16040000 starting USB... Bus xhci_pci: Register 5000420 NbrPorts 5 Starting the controller USB XHCI 1.00 scanning bus xhci_pci for devices... 4 USB Device(s) found scanning usb for storage devices... 0 Storage Device(s) found Working FDT set to ff72e9b0 Hit any key to stop autoboot: 0 StarFive # usb tree USB device tree: 1 Hub (5 Gb/s, 0mA) | U-Boot XHCI Host Controller | +-2 Hub (480 Mb/s, 100mA) | USB2.0 Hub | +-3 Human Interface (1.5 Mb/s, 100mA) | YSPRINGTECH USB OPTICAL MOUSE | +-4 Human Interface (1.5 Mb/s, 100mA) YSPRINGTECH USB OPTICAL MOUSE ``` Boot system, device disappears; ```bash Loading Linux 6.11.0-rc6-100-default ... Loading initial ramdisk ... EFI stub: Booting Linux Kernel... EFI stub: Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path EFI stub: Using DTB from configuration table <== USB disappears her EFI stub: Exiting boot services... usb-devices find: ‘/sys/bus/usb/devices’: No such file or directory ``` Expected Results: Any attached USB device is present in the output from lsusb or usb-devices. -- You are receiving this mail because: You are on the CC list for the bug.

1 3