December 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1234125] The osc build/shell command with kvm creates root:root owned source tree
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234125 https://bugzilla.suse.com/show_bug.cgi?id=1234125#c4 --- Comment #4 from Adrian Schröter <adrian.schroeter(a)suse.com> --- and which build version? Can you try to use the ones from openSUSE:Tools project? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1233847] New: VUL-0: CVE-2024-21538: element-web,element-desktop: cross-spawn: regular expression denial of service
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233847 Bug ID: 1233847 Summary: VUL-0: CVE-2024-21538: element-web,element-desktop: cross-spawn: regular expression denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/427356/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: dheidler(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1233843 Target Milestone: --- Found By: --- Blocker: --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d80… https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601… https://github.com/moxystudio/node-cross-spawn/pull/160 https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 https://bugzilla.redhat.com/show_bug.cgi?id=2324550 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1233590] GCC14 C++ CTAD failure due to ambiguous overload
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233590 https://bugzilla.suse.com/show_bug.cgi?id=1233590#c5 Richard Biener <rguenther(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #5 from Richard Biener <rguenther(a)suse.com> --- The fix doesn't seem to be perfect, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117855 though it seems to be clear progression. I hope this gets resolved soon and I'll pick both then (SLE/Leap will also receive 14.3 but that's expected to be released only end of April 2025). As a workaround you can use -std=gnu++20 - not sure why people always jump to new standards when they are not yet default (the default is still -std=gnu++17!). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1233590] GCC14 C++ CTAD failure due to ambiguous overload
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233590 Richard Biener <rguenther(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://gcc.gnu.org/bugzill | |a/show_bug.cgi?id=116276 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193250] [META] Fully switch TW to DRM graphics drivers and disable fbdev drivers
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1193250 Paolo Stivanin <pstivanin(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|pstivanin(a)suse.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234134] AUDIT-0: timekpr-next: review of new D-Bus service com.timekpr.server, new polkit action com.ubuntu.timekpr.pkexec
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234134 https://bugzilla.suse.com/show_bug.cgi?id=1234134#c1 Wolfgang Frisch <wolfgang.frisch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team(a)suse.de |wolfgang.frisch(a)suse.com CC| |wolfgang.frisch(a)suse.com Status|NEW |CONFIRMED --- Comment #1 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Thanks for opening this bug report. I will work on this. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234134] New: AUDIT-0: timekpr-next: review of new D-Bus service com.timekpr.server, new polkit action com.ubuntu.timekpr.pkexec
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234134 Bug ID: 1234134 Summary: AUDIT-0: timekpr-next: review of new D-Bus service com.timekpr.server, new polkit action com.ubuntu.timekpr.pkexec Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: svalx78(a)gmail.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- For package found in OBS in X11:Utilities:timekpr-next I would like a whitelisting for the following rpmlint errors: timekpr-next.noarch: E: polkit-untracked-privilege (Badness: 10) com.ubuntu.timekpr.pkexec (auth_admin:auth_admin:auth_admin) The polkit action is not listed in the polkit-default-privs profiles which makes it harder for admins to find. Furthermore improper polkit authorization checks can easily introduce security issues. timekpr-next.noarch: E: dbus-file-unauthorized (Badness: 10) /usr/share/dbus-1/system.d/timekpr.conf (sha256 file digest default filter:499245aea51f15a98d88a81e0352b9f3c7a1acad3abc53b5ca1ec5dd10e8441a shell filter:670fbbd637a7db138caded139420cb5bc41f24b4a3a1106cde4fb2f489f71ffb xml filter:37117f57a599e1d0b8f565e493b6dc1c152683ea6d9fa8183e7f592143713934) Packaging D-Bus services requires a review and whitelisting by the SUSE security team. Package can be found at https://build.opensuse.org/package/show/X11:Utilities/timekpr-next Sources at https://launchpad.net/timekpr-next I am plan to submit this package to Factory. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225574] New: AUDIT-FIND: apache2-mod_mono: configuration defaults to predictable socket path in /tmp
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1225574 Bug ID: 1225574 Summary: AUDIT-FIND: apache2-mod_mono: configuration defaults to predictable socket path in /tmp Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- apache2-mod_mono, by default, creates a socket `/tmp/mod_mono_server_global`, allowing unprivileged users to break the module by creating an identically named file in that location. However a) this behavior is documented b) it is mitigated by a systemd hardening in the apache2 package: > [Unit] > Description=The Apache Webserver > After=network.target nss-lookup.target time-sync.target remote-fs.target > Before=getty(a)tty1.service plymouth-quit.service xdm.service > PartOf=apache2.target > [Service] > Type=notify > PrivateTmp=true -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1193250] [META] Fully switch TW to DRM graphics drivers and disable fbdev drivers
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1193250 Jeffrey Cheung <jcheung(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227378] New: /usr/bin/idle* don't have executable bits
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1227378 Bug ID: 1227378 Summary: /usr/bin/idle* don't have executable bits Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- tumbleweed-pkg~$ l /usr/bin/*idle* -rw-r--r--. 1 root root 94 čen 25 23:57 /usr/bin/idle3.11 -rw-r--r--. 1 root root 94 čen 30 21:20 /usr/bin/idle3.13 tumbleweed-pkg~$ -- You are receiving this mail because: You are on the CC list for the bug.

1 15