December 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1203617] In plasma5 midnight commander doesn't exit to current directory anymore
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1203617 https://bugzilla.suse.com/show_bug.cgi?id=1203617#c104 --- Comment #104 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:4378-1: An update that has one fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20244378-1 Category: recommended (moderate) Bug References: 1203617 Maintenance Incident: [SUSE:Maintenance:36719](https://smelt.suse.de/incident/36719/) Sources used: openSUSE Leap 15.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 openSUSE Leap Micro 5.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 openSUSE Leap 15.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 openSUSE Leap 15.6 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Basesystem Module 15-SP5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Basesystem Module 15-SP6 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Development Tools Module 15-SP5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Development Tools Module 15-SP6 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.2 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234697] New: dbus-broker misses systemd PreRequires
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234697 Bug ID: 1234697 Summary: dbus-broker misses systemd PreRequires Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When I debugged update problems I run again into bsc#1229813 This time it was easy to find the reason: dbus-broker misses a Requires(pre): systemd >= 253.6 Without this Requires, post install scripts of dbus-broker are not executed, dbus.service does not exist and dbus cannot be started. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1229813] New: dbus.socket does not start dbus-broker.service
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229813 Bug ID: 1229813 Summary: dbus.socket does not start dbus-broker.service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Services which require dbus have a dependency on dbus.socket in their service file. dbus-broker has no dbus.service file, thus this dependencies are broken and a boot only succeeds by pure luck. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1234667] New: Displaylink / evdi driver detects only one external screen
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234667 Bug ID: 1234667 Summary: Displaylink / evdi driver detects only one external screen Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Drivers Assignee: kernel-bugs(a)suse.de Reporter: cookie170(a)web.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since some weeks the displaylink driver never finds the third screen (laptop integrated, external 1 + 2). Used to work for at least six monthes. I tried everything, all repos offering evdi / displaylink. Both external screens are connected to the Lenovo Hybrid dock. xrandr neither finds the third screens. If nobody else has been hit by this, then the cable might be broken, but how can a cable lying on a desk break? There seems to be an issue: https://www.displaylink.org/forum/showthread.php?p=97631 https://bbs.archlinux.org/viewtopic.php?id=301305 I'm very motivated to help debugging, where to start? -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234361] New: VUL-0: chromium: 131.0.6778.139 stable release
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234361 Bug ID: 1234361 Summary: VUL-0: chromium: 131.0.6778.139 stable release Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ro(a)suse.com Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-des… Fix in Chromium 131.0.6778.139 * CVE-2024-12381: Type Confusion in V8 * CVE-2024-12382: Use after free in Translate * Various fixes from internal audits, fuzzing and other initiatives -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234405] New: devel:microos/libeconf: Bug libeconf 0.7.5 causes systemd/sddm/pam/libc crash and prevents login
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234405 Bug ID: 1234405 Summary: devel:microos/libeconf: Bug libeconf 0.7.5 causes systemd/sddm/pam/libc crash and prevents login Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: rbrown(a)suse.com Reporter: pallaswept(a)proton.me QA Contact: screening-team-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 879108 --> https://bugzilla.suse.com/attachment.cgi?id=879108&action=edit output of `journalctl -b -2 |rg dumped -A 40` After today's dup, I rebooted to a desktop with a mouse cursor and otherwise unresponsive. Switching to a TTY showed an error "Unable to start user manager for user 1000". I was unable to login with any account including root. Using the recovery console, I was able to retrieve logs, find this culprit, rollback, and am currently working after locking out the libeconf updates with `sudo zypper al libeconf0 libeconf0-32bit libeconf-devel` Not sure if this is just me, hopefully it is. I did have some custom pam config, which I naturally removed to test, and there was no change, but I did notice that `rpm -qf /etc/pam.d/*` returns several "file foo is not owned by any package", and none of those files are mine. I'm not sure if this is intentional or if it is related. Relevant section of the journal is attached. Please let me know if I can help in any way. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1234703] New: VUL-0: CVE-2024-56128: kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234703 Bug ID: 1234703 Summary: VUL-0: CVE-2024-56128: kafka: SCRAM authentication vulnerable to replay attacks when used without encryption Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/433309/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1]. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message. However, Kafka's SCRAM implementation did not perform this validation. Impact: This vulnerability is exploitable only when an attacker has plaintext access to the SCRAM authentication exchange. However, the usage of SCRAM over plaintext is strongly discouraged as it is considered an insecure practice [2]. Apache Kafka recommends deploying SCRAM exclusively with TLS encryption to protect SCRAM exchanges from interception [3]. Deployments using SCRAM with TLS are not affected by this issue. How to Detect If You Are Impacted: If your deployment uses SCRAM authentication over plaintext communication channels (without TLS encryption), you are likely impacted. To check if TLS is enabled, review your server.properties configuration file for listeners property. If you have SASL_PLAINTEXT in the listeners, then you are likely impacted. Fix Details: The issue has been addressed by introducing nonce verification in the final message of the SCRAM authentication exchange to ensure compliance with RFC 5802. Affected Versions: Apache Kafka versions 0.10.2.0 through 3.9.0, excluding the fixed versions below. Fixed Versions: 3.9.0 3.8.1 3.7.2 Users are advised to upgrade to 3.7.2 or later to mitigate this issue. Recommendations for Mitigation: Users unable to upgrade to the fixed versions can mitigate the issue by: - Using TLS with SCRAM Authentication: Always deploy SCRAM over TLS to encrypt authentication exchanges and protect against interception. - Considering Alternative Authentication Mechanisms: Evaluate alternative authentication mechanisms, such as PLAIN, Kerberos or OAuth with TLS, which provide additional layers of security. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-56128 https://www.cve.org/CVERecord?id=CVE-2024-56128 https://datatracker.ietf.org/doc/html/rfc5802 https://datatracker.ietf.org/doc/html/rfc5802#section-9 https://kafka.apache.org/documentation/#security_sasl_scram_security https://lists.apache.org/thread/84dh4so32lwn7wr6c5s9mwh381vx9wkw https://seclists.org/oss-sec/2024/q4/162 http://www.openwall.com/lists/oss-security/2024/12/18/3 https://bugzilla.redhat.com/show_bug.cgi?id=2333013 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/56xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234506] New: VUL-0: : tailscale: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234506 Bug ID: 1234506 Summary: VUL-0: : tailscale: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/432234/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1234482 Target Milestone: --- Found By: --- Blocker: --- Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45337 https://www.cve.org/CVERecord?id=CVE-2024-45337 https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb… https://go.dev/cl/635315 https://go.dev/issue/70779 https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ https://pkg.go.dev/vuln/GO-2024-3321 http://www.openwall.com/lists/oss-security/2024/12/11/2 https://bugzilla.redhat.com/show_bug.cgi?id=2331720 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1234406] New: bind package root.hints outdated
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234406 Bug ID: 1234406 Summary: bind package root.hints outdated Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: patrick.schaaf(a)yalwa.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Package bind-9.20.3-1.1.x86_64, current as of tumbleweed 20241210, contains an outdated root.hints file. Canonical source is https://www.internic.net/domain/named.root and has for b.root-servers.net > ; last update: November 20, 2024 > B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 > B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b Packaged file has > ; last update: July 28, 2021 > B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201 > B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b I noticed this because apparently bind has a builtin list, and using that, puts this warning into syslog: Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A (170.247.170.2) missing from hints Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A (199.9.14.201) extra record in hints Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA (2801:1b8:10::b) missing from hints Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA (2001:500:200::b) extra record in hints -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1234691] Yast2: Add "About" section or button to show program and module versions, show yast version in terminal
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234691 https://bugzilla.suse.com/show_bug.cgi?id=1234691#c1 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WONTFIX Status|NEW |RESOLVED --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- That information is easily obtainable from /var/log/YaST/y2log (the UI versions) or from rpm -qa "libyui*" rpm -qa "yast2*" There is no need to clutter the UI with it, even less so since YaST consists of several dozen packages; and it's of very limited use to almost all users. -- You are receiving this mail because: You are on the CC list for the bug.

1 0