December 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1234627] New: VUL-0: CVE-2024-7701: percona-toolkit: use of password hash with insufficient computational effort
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234627 Bug ID: 1234627 Summary: VUL-0: CVE-2024-7701: percona-toolkit: use of password hash with insufficient computational effort Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/432929/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7701 https://www.cve.org/CVERecord?id=CVE-2024-7701 https://github.com/percona/percona-toolkit/blob/aa1ac0e6889168fddf73c3a72d4… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1234587] New: VUL-0: CVE-2024-45337: copacetic: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234587 https://bugzilla.suse.com/show_bug.cgi?id=1234587#c1 Bug ID: 1234587 Summary: VUL-0: CVE-2024-45337: copacetic: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/432234/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/ S:U/C:H/I:H/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: containers-bugowner(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1234482 Target Milestone: --- Found By: --- Blocker: --- --- Comment #1 from Andrea Mattiazzo <andrea.mattiazzo(a)suse.com> --- Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45337 https://www.cve.org/CVERecord?id=CVE-2024-45337 https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb… https://go.dev/cl/635315 https://go.dev/issue/70779 https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ https://pkg.go.dev/vuln/GO-2024-3321 http://www.openwall.com/lists/oss-security/2024/12/11/2 https://bugzilla.redhat.com/show_bug.cgi?id=2331720 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1234454] Compiling external modules fails with "/usr/src/linux-6.13.0-rc2-1.gf92fc5d/include/config/auto.conf: No such file or directory"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234454 https://bugzilla.suse.com/show_bug.cgi?id=1234454#c3 --- Comment #3 from Jiri Slaby <jslaby(a)suse.com> --- I pushed this to users/jslaby/packaging/for-next: commit 46168e55d3d7bc89b41fea32415554adfc550061 (HEAD -> packaging, origin/users/jslaby/packaging/for-next) Author: Jiri Slaby <jslaby(a)suse.cz> Date: Fri Dec 13 12:42:17 2024 +0100 rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234605] Userspace crashes on parallels VM
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234605 https://bugzilla.suse.com/show_bug.cgi?id=1234605#c1 Ivan Ivanov <ivan.ivanov(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kernel-bugs(a)opensuse.org |ivan.ivanov(a)suse.com CC| |ivan.ivanov(a)suse.com Status|NEW |IN_PROGRESS --- Comment #1 from Ivan Ivanov <ivan.ivanov(a)suse.com> --- Thanks, I will take a look... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1233079] New: zipl errors out: Unsupported setup: data starts at boot area on (254:0)
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233079 Bug ID: 1233079 Summary: zipl errors out: Unsupported setup: data starts at boot area on (254:0) Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: S/390-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: ro(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- see also bug#1230345 for the setup. s390zl21:~ # zipl -c /boot2/zipl.conf Using config file '/boot2/zipl.conf' (from command line) Run /lib/s390-tools/zipl_helper.device-mapper 254:0 Error: Unsupported setup: data starts at boot area on (254:0) Error: Inconsistent script output mountpoint /boot2: /dev/mapper/3600507630bffd2160000000000002000 4120288 352624 3557952 10% /boot2 s390zl21:~ # multipath -ll 3600507630bffd2160000000000002000 3600507630bffd2160000000000002000 dm-0 IBM,2107900 size=4.0G features='1 queue_if_no_path' hwhandler='1 alua' wp=rw `-+- policy='service-time 0' prio=50 status=active |- 0:0:1:1073758240 sda 8:0 active ready running `- 1:0:1:1073758240 sdh 8:112 active ready running -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 351064] Integrated Security=SSPI still requires username and password... missing the point ot Integrated Security=SSPI
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=351064 https://bugzilla.suse.com/show_bug.cgi?id=351064#c2 David Disseldorp <ddiss(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WONTFIX Version|1.2.4 |Leap 15.3 CC| |ddiss(a)suse.com Status|NEW |RESOLVED Component|Sys.Data.SqlClient |Samba QA Contact|mono-bugs(a)lists.ximian.com |samba-maintainers(a)SuSE.de Product|Mono: Class Libraries |openSUSE Distribution Assignee|mono-bugs(a)lists.ximian.com |samba-maintainers(a)SuSE.de --- Comment #2 from David Disseldorp <ddiss(a)suse.com> --- Windows XP is EOL. Please raise this with upstream Mono if AD domain auth (e.g. via winbind) is still desired. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234625] New: After latest kernel drivers update of today the latest kernel will not boot
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234625 Bug ID: 1234625 Summary: After latest kernel drivers update of today the latest kernel will not boot Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: rskunath(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- There were many kernel drivers updated along with today's update. After installing these the current kernel (6.11.8) will not boot. It gets to GRUB, I select the current kernel, then the screen black, remains that way for a long while and the PC powers itself off. The previous kernel (6.11.7) does boot and runs fine. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1234626] FreeCAD 1.0 cannot be installed due to an unresolvable dependency
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234626 https://bugzilla.suse.com/show_bug.cgi?id=1234626#c1 Michael Pujos <pujos.michael(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pujos.michael(a)gmail.com --- Comment #1 from Michael Pujos <pujos.michael(a)gmail.com> --- I needs to be recompiled. Current package does not compile but I have done a SR that should fix it: https://build.opensuse.org/request/show/1231276 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234626] New: FreeCAD 1.0 cannot be installed due to an unresolvable dependency
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234626 Bug ID: 1234626 Summary: FreeCAD 1.0 cannot be installed due to an unresolvable dependency Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: Michael.Zapf(a)mizapf.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- FreeCAD 1.0 cannot be installed due to an unresolvable dependency: "nothing provides 'libTKBRep.so.7.7.2()(64bit)' needed by the to be installed FreeCAD-1.0.0-1.2.x86_64" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234622] openSUSE-SLE-15.5-2023-4619 - Security update for sqlite3 has no debugsource or debuginfo
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234622 https://bugzilla.suse.com/show_bug.cgi?id=1234622#c2 --- Comment #2 from Richard Parkins <aleph0hpela-bugz(a)yahoo.co.uk> --- It seems that YaST on my machine was configured to look in cdn.opensuse.org, which seems not to have contained the debug update, instead of download.opensuse.org. I don't know where cdn.opensuse.org came from, but I don't think I could have thought of it for myself. Either some rogue update put it into /usr/share/zypp/local/service/openSUSE/repo/opensuse-leap-repoindex.xml, or it came from the on-line installation. -- You are receiving this mail because: You are on the CC list for the bug.

1 0