November 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1229813] New: dbus.socket does not start dbus-broker.service
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229813 Bug ID: 1229813 Summary: dbus.socket does not start dbus-broker.service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Services which require dbus have a dependency on dbus.socket in their service file. dbus-broker has no dbus.service file, thus this dependencies are broken and a boot only succeeds by pure luck. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1226207] New: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226207 Bug ID: 1226207 Summary: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- kf6-breeze-icons generate identical icons for both breeze & breeze-dark. While this is not an issue for KF6 apps, that use run-time recoloring, in KF5 apps, like Krusader, when dark color theme is used and icons are breeze-dark symbolic icons are dark on dark background and almost invisible. The reason is this build option: `-DWITH_ICON_GENERATION:BOOL=FALSE` I've tried to make my custom build [1] switching it to TRUE and breeze-dark icons are fine with Krusader now. But I don't know the reasoning behind switching it to FALSE. There is comment: ``` saves ~30MB and installs dangling symlinks ``` Less size is true, though IMHO it's not a good solution to break KF5 apps to save some space. But I can't see any dangling symlinks: ``` find /usr/share/icons/breeze{,-dark} -xtype l ``` doesn't find anything. Any other reason or should I cleanup [1] and make a submit request? [1] https://build.opensuse.org/package/show/home:NickLion:branches:KDE:Framewor… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1233134] New: boot freeze with kernel-default=5.14.21-150500.55.86 and amdgpu
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233134 Bug ID: 1233134 Summary: boot freeze with kernel-default=5.14.21-150500.55.86 and amdgpu Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: heiko.rommel(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After having installed version 5.14.21-150500.55.86 of the kernel release candidate for SLE 15 SP5 / openSUSE 15.5 on my desktop, the system hangs in early boot with no video signal. When booting with loglevel=7 and drm.debug=0x1e I see that there are apparently some errors in drm, but they are only displayed for a very short time (< 1 sec) and then the signal to the display is cut off. The GPU is a discrete AMD Radeon RX 7800 XT. What did work: a) booting with nomodeset b) creating an update directory in /lib/modules/ for the new kernel and putting there the amdgpu.ko.zst from the previous kernel, rebuilding the initrd and booting (see https://bugzilla.suse.com/show_bug.cgi?id=1215802#c11) This looks like an re-incarnation of https://bugzilla.suse.com/show_bug.cgi?id=1215802 reported 14 month ago, but maybe with different root problems. Currently, I am trying to get a legible video of the booting. -- You are receiving this mail because: You are on the CC list for the bug.

1 28

[Bug 1229913] New: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229913 Bug ID: 1229913 Summary: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: popov895(a)ukr.net Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1205607 We've been asked to have a fresh look ad kio-admin, formerly rejected in bug 1205607. AFAIK upstream activities to come up with a robust API have been abandoned, but we can still have another look at the current production code. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1233853] New: VUL-0: CVE-2024-21538: python-jupyterlab-templates,jupyter-jupyterlab-latex: cross-spawn: regular expression denial of service
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233853 Bug ID: 1233853 Summary: VUL-0: CVE-2024-21538: python-jupyterlab-templates,jupyter-jupyterlab-latex: cross-spawn: regular expression denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/427356/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1233843 Target Milestone: --- Found By: --- Blocker: --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d80… https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601… https://github.com/moxystudio/node-cross-spawn/pull/160 https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 https://bugzilla.redhat.com/show_bug.cgi?id=2324550 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1233852] New: VUL-0: CVE-2024-21538: python-furo,python-jupyter-ydoc,python-ipympl,python-nbdime,python-pytest-html,python-panel: cross-spawn: regular expression denial of service
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233852 Bug ID: 1233852 Summary: VUL-0: CVE-2024-21538: python-furo,python-jupyter-ydoc,python-ipympl,python-n bdime,python-pytest-html,python-panel: cross-spawn: regular expression denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/427356/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: daniel.garcia(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1233843 Target Milestone: --- Found By: --- Blocker: --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d80… https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601… https://github.com/moxystudio/node-cross-spawn/pull/160 https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 https://bugzilla.redhat.com/show_bug.cgi?id=2324550 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1233752] New: [Build E.84.3] openQA test fails in trup_smoke
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233752 Bug ID: 1233752 Summary: [Build E.84.3] openQA test fails in trup_smoke Classification: openSUSE Product: openSUSE Distribution Version: Leap 16.0 Hardware: Other URL: https://openqa.opensuse.org/tests/4657304/modules/trup _smoke/steps/26 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation openQA test in scenario microos-Staging:E-Staging-MicroOS-Image-sdboot-x86_64-microos-wizard-tpm@uefi-staging fails in [trup_smoke](https://openqa.opensuse.org/tests/4657304/modules/trup_smoke/st… ## Test suite description Like MicroOS, but use neither combustion nor ignition for the intial configuration, so jeos-firstboot runs. ## Reproducible Fails since (at least) Build [E.84.3](https://openqa.opensuse.org/tests/4657304) (current job) ## Expected result Last good: [E.83.16](https://openqa.opensuse.org/tests/4648526) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=microos… -- You are receiving this mail because: You are on the CC list for the bug.

1 46

[Bug 1233016] New: memory buff/cache issue with qemu
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233016 Bug ID: 1233016 Summary: memory buff/cache issue with qemu Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Kernel:Storage Assignee: kernel-bugs(a)suse.de Reporter: itservice(a)knut-krueger.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When a Windows VM is started, possibly also a Linux VM with high memory allocation, the buff/cache fills up instead of emptying if there is not enough free memory. In addition, the swap is filled more and more, the wait states increase. At some point, keyboard and mouse inputs are impossible. It is definitely not due to the VM, because if you boot with kernel 6.10.9-1-default ID=“opensuse-tumbleweed” ID_LIKE=“opensuse suse” VERSION_ID=“20241104” the memory allocation works perfectly. Here is the whole thread that helped troubleshooting with screenprints from TOP: https://forums.opensuse.org/t/kvm-partially-and-irregularly-freezes-the-win… -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5