December 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1062303] trackerbug: packages do not build reproducibly from randomness
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1062303 Bernhard Wiedemann <bwiedemann(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1234709 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203617] In plasma5 midnight commander doesn't exit to current directory anymore
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1203617 https://bugzilla.suse.com/show_bug.cgi?id=1203617#c104 --- Comment #104 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:4378-1: An update that has one fix can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20244378-1 Category: recommended (moderate) Bug References: 1203617 Maintenance Incident: [SUSE:Maintenance:36719](https://smelt.suse.de/incident/36719/) Sources used: openSUSE Leap 15.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 openSUSE Leap Micro 5.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 openSUSE Leap 15.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 openSUSE Leap 15.6 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Basesystem Module 15-SP5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Basesystem Module 15-SP6 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Development Tools Module 15-SP5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 Development Tools Module 15-SP6 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro 5.2 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229813] New: dbus.socket does not start dbus-broker.service
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229813 Bug ID: 1229813 Summary: dbus.socket does not start dbus-broker.service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Services which require dbus have a dependency on dbus.socket in their service file. dbus-broker has no dbus.service file, thus this dependencies are broken and a boot only succeeds by pure luck. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1234697] New: dbus-broker misses systemd PreRequires
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234697 Bug ID: 1234697 Summary: dbus-broker misses systemd PreRequires Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When I debugged update problems I run again into bsc#1229813 This time it was easy to find the reason: dbus-broker misses a Requires(pre): systemd >= 253.6 Without this Requires, post install scripts of dbus-broker are not executed, dbus.service does not exist and dbus cannot be started. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234361] New: VUL-0: chromium: 131.0.6778.139 stable release
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234361 Bug ID: 1234361 Summary: VUL-0: chromium: 131.0.6778.139 stable release Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ro(a)suse.com Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-des… Fix in Chromium 131.0.6778.139 * CVE-2024-12381: Type Confusion in V8 * CVE-2024-12382: Use after free in Translate * Various fixes from internal audits, fuzzing and other initiatives -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234405] New: devel:microos/libeconf: Bug libeconf 0.7.5 causes systemd/sddm/pam/libc crash and prevents login
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234405 Bug ID: 1234405 Summary: devel:microos/libeconf: Bug libeconf 0.7.5 causes systemd/sddm/pam/libc crash and prevents login Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: rbrown(a)suse.com Reporter: pallaswept(a)proton.me QA Contact: screening-team-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 879108 --> https://bugzilla.suse.com/attachment.cgi?id=879108&action=edit output of `journalctl -b -2 |rg dumped -A 40` After today's dup, I rebooted to a desktop with a mouse cursor and otherwise unresponsive. Switching to a TTY showed an error "Unable to start user manager for user 1000". I was unable to login with any account including root. Using the recovery console, I was able to retrieve logs, find this culprit, rollback, and am currently working after locking out the libeconf updates with `sudo zypper al libeconf0 libeconf0-32bit libeconf-devel` Not sure if this is just me, hopefully it is. I did have some custom pam config, which I naturally removed to test, and there was no change, but I did notice that `rpm -qf /etc/pam.d/*` returns several "file foo is not owned by any package", and none of those files are mine. I'm not sure if this is intentional or if it is related. Relevant section of the journal is attached. Please let me know if I can help in any way. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1234703] New: VUL-0: CVE-2024-56128: kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234703 Bug ID: 1234703 Summary: VUL-0: CVE-2024-56128: kafka: SCRAM authentication vulnerable to replay attacks when used without encryption Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/433309/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1]. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message. However, Kafka's SCRAM implementation did not perform this validation. Impact: This vulnerability is exploitable only when an attacker has plaintext access to the SCRAM authentication exchange. However, the usage of SCRAM over plaintext is strongly discouraged as it is considered an insecure practice [2]. Apache Kafka recommends deploying SCRAM exclusively with TLS encryption to protect SCRAM exchanges from interception [3]. Deployments using SCRAM with TLS are not affected by this issue. How to Detect If You Are Impacted: If your deployment uses SCRAM authentication over plaintext communication channels (without TLS encryption), you are likely impacted. To check if TLS is enabled, review your server.properties configuration file for listeners property. If you have SASL_PLAINTEXT in the listeners, then you are likely impacted. Fix Details: The issue has been addressed by introducing nonce verification in the final message of the SCRAM authentication exchange to ensure compliance with RFC 5802. Affected Versions: Apache Kafka versions 0.10.2.0 through 3.9.0, excluding the fixed versions below. Fixed Versions: 3.9.0 3.8.1 3.7.2 Users are advised to upgrade to 3.7.2 or later to mitigate this issue. Recommendations for Mitigation: Users unable to upgrade to the fixed versions can mitigate the issue by: - Using TLS with SCRAM Authentication: Always deploy SCRAM over TLS to encrypt authentication exchanges and protect against interception. - Considering Alternative Authentication Mechanisms: Evaluate alternative authentication mechanisms, such as PLAIN, Kerberos or OAuth with TLS, which provide additional layers of security. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-56128 https://www.cve.org/CVERecord?id=CVE-2024-56128 https://datatracker.ietf.org/doc/html/rfc5802 https://datatracker.ietf.org/doc/html/rfc5802#section-9 https://kafka.apache.org/documentation/#security_sasl_scram_security https://lists.apache.org/thread/84dh4so32lwn7wr6c5s9mwh381vx9wkw https://seclists.org/oss-sec/2024/q4/162 http://www.openwall.com/lists/oss-security/2024/12/18/3 https://bugzilla.redhat.com/show_bug.cgi?id=2333013 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/56xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234406] New: bind package root.hints outdated
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234406 Bug ID: 1234406 Summary: bind package root.hints outdated Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: patrick.schaaf(a)yalwa.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Package bind-9.20.3-1.1.x86_64, current as of tumbleweed 20241210, contains an outdated root.hints file. Canonical source is https://www.internic.net/domain/named.root and has for b.root-servers.net > ; last update: November 20, 2024 > B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 > B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b Packaged file has > ; last update: July 28, 2021 > B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201 > B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b I noticed this because apparently bind has a builtin list, and using that, puts this warning into syslog: Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A (170.247.170.2) missing from hints Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A (199.9.14.201) extra record in hints Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA (2801:1b8:10::b) missing from hints Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA (2001:500:200::b) extra record in hints -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1234691] Yast2: Add "About" section or button to show program and module versions, show yast version in terminal
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234691 https://bugzilla.suse.com/show_bug.cgi?id=1234691#c1 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WONTFIX Status|NEW |RESOLVED --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- That information is easily obtainable from /var/log/YaST/y2log (the UI versions) or from rpm -qa "libyui*" rpm -qa "yast2*" There is no need to clutter the UI with it, even less so since YaST consists of several dozen packages; and it's of very limited use to almost all users. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226207] New: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226207 Bug ID: 1226207 Summary: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- kf6-breeze-icons generate identical icons for both breeze & breeze-dark. While this is not an issue for KF6 apps, that use run-time recoloring, in KF5 apps, like Krusader, when dark color theme is used and icons are breeze-dark symbolic icons are dark on dark background and almost invisible. The reason is this build option: `-DWITH_ICON_GENERATION:BOOL=FALSE` I've tried to make my custom build [1] switching it to TRUE and breeze-dark icons are fine with Krusader now. But I don't know the reasoning behind switching it to FALSE. There is comment: ``` saves ~30MB and installs dangling symlinks ``` Less size is true, though IMHO it's not a good solution to break KF5 apps to save some space. But I can't see any dangling symlinks: ``` find /usr/share/icons/breeze{,-dark} -xtype l ``` doesn't find anything. Any other reason or should I cleanup [1] and make a submit request? [1] https://build.opensuse.org/package/show/home:NickLion:branches:KDE:Framewor… -- You are receiving this mail because: You are on the CC list for the bug.

1 8