December 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1234622] New: openSUSE-SLE-15.5-2023-4619 - Security update for sqlite3 has no debugsource or debuginfo
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234622 Bug ID: 1234622 Summary: openSUSE-SLE-15.5-2023-4619 - Security update for sqlite3 has no debugsource or debuginfo Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Minor Priority: P5 - None Component: Maintenance Assignee: maintenance(a)opensuse.org Reporter: aleph0hpela-bugz(a)yahoo.co.uk QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- openSUSE-SLE-15.5-2023-4619 - Security update for sqlite3 does not install debugsource or debuginfo. This makes it impossible to to step through the sqlite library in order to identify a problem which is causing a program which uses that library to behave incorrectly. I have had to back up to Sqlite: 3.39.3 which seems to be the latest version for which debugsource and debuginfo are available. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1234301] Login screen does not display after update to 20241205
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234301 https://bugzilla.suse.com/show_bug.cgi?id=1234301#c24 Peter Urban <peter.urban(a)open-slx.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |peter.urban(a)open-slx.com --- Comment #24 from Peter Urban <peter.urban(a)open-slx.com> --- For posterity, I also had this issue but with much older HW than you, Alan. Confirming that for my combo i7-6820HQ with Intel HD Graphics 530 and Nvidia Quadro M1200 this fix in TW20241209 resolved the no login screen (crashed SDDM greeter process and Xorg receiving SIGTERM seen in journal) issue for me. Thx! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234621] New: [SELinux] full relabelling required after booting to recovery/single-user mode
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234621 Bug ID: 1234621 Summary: [SELinux] full relabelling required after booting to recovery/single-user mode Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: pallaswept(a)proton.me QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: Tumbleweed SELinux status, mode and policy name: Enabled, enforcing, targeted SELinux policy version and repository: 20241206-1.1 Any other important details: I did not include the logs here because they are basically just everything failing because nothing is correctly labelled. This may be intentional, since selecting the 'recovery mode' entry in grub, does not set the selinux boot parameters. If it is not intentional, I thought that maybe a good way to deal with this, would be to use GRUB_CMDLINE_LINUX_RECOVERY and add `security=selinux selinux=1` there, as well as in GRUB_CMDLINE_LINUX_DEFAULT? Since I migrated this system from apparmour manually, I added the parameters to the default boot entries. I'm not sure how they are added automatically during a new installation, though. Perhaps it should have been added to the recovery params, as well, and would be in a new installation? Maybe the grub os-prober script isn't working as intended? Sorry I'm not clear on how it is intended to work. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234620] New: [SELinux] virt-manager fails with AVC denial
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234620 Bug ID: 1234620 Summary: [SELinux] virt-manager fails with AVC denial Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: pallaswept(a)proton.me QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: Tumbleweed SELinux status, mode and policy name: Enabled, enforcing, targeted SELinux policy version and repository: 20241206-1.1 The software (incl. version) that is affected by the SELinux issue and the error message: virt-manager 5.0.0 SELinux Audit log: ---- time->Sun Dec 15 16:46:50 2024 type=AVC msg=audit(1734241610.405:173): avc: denied { watch } for pid=48748 comm="daemon-init" path="/etc/mdevctl.d" dev="nvme0n1p2" ino=410398 scontext=system_u:system_r:virtnodedevd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 ---- time->Sun Dec 15 16:46:55 2024 type=AVC msg=audit(1734241615.025:176): avc: denied { watch } for pid=48748 comm="gmain" path="/etc/mdevctl.d" dev="nvme0n1p2" ino=410398 scontext=system_u:system_r:virtnodedevd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 ---- Any other important details: One of the first message, then the second message repeats once every 4 seconds. virt-manager UI graphs are empty. restorecon indicates that the file is already correctly labelled. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234619] New: CPU reporting and using incorrect max freq
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234619 Bug ID: 1234619 Summary: CPU reporting and using incorrect max freq Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: ez2blost(a)yahoo.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On an Intel i9-13900HX, /sys/devices/system/cpu/cpu*/cpufreq/cpuinfo_max_freq reports the same frequency as base_frequency. E.g., cat /sys/devices/system/cpu/cpu0/cpufreq/{base_frequency,cpuinfo_max_freq} 2200000 2200000 By default the maximum scaling frequency for performance is set to the cpuinfo_max_freq cat /sys/devices/system/cpu/cpu1/cpufreq/scaling_max_freq 2200000 However the maximum frequency for cpu1 is 5400000 as can be seen if a higher valuer is written to scaling_max_freq: echo 10000000 >| /sys/devices/system/cpu/cpu1/cpufreq/scaling_max_freq ; cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq 5400000 By default the cpu frequency never exceeds 2.2Ghz resulting in poor performance. A workaround is to set the maximum scaling frequency in the TLP configuration file (if tlp is used), e.g. Echo "CPU_SCALING_MAX_FREQ_ON_AC=5400000" >> /etc/tlp.d/50.local.conf This is partial fix because other software, such as NVIDIA power management features, can reset the scaling_max_frequency to cpuinfo_max_frequency, and cannot be enabled easily without a performance hit. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1174279] FreeCad has unmet/broken dependencies
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1174279 https://bugzilla.suse.com/show_bug.cgi?id=1174279#c11 Michael Zapf <Michael.Zapf(a)mizapf.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- CC| |Michael.Zapf(a)mizapf.de --- Comment #11 from Michael Zapf <Michael.Zapf(a)mizapf.de> --- FreeCAD 1.0 cannot be installed due to an unresolvable dependency: "nothing provides 'libTKBRep.so.7.7.2()(64bit)' needed by the to be installed FreeCAD-1.0.0-1.2.x86_64" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234618] New: Add package for Brother printers
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234618 Bug ID: 1234618 Summary: Add package for Brother printers Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Patterns Assignee: rbrown(a)suse.com Reporter: emtorres(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I have a Brother laser printer. The system correctly autodetects the printer, but since it does not have the 'brlaser' driver, it adds it as if it were an HP printer. It could be useful as it supports multiple Brother laser printers (don't know how popular Brother printers are :)). The package is printer-driver-brlaser Thanks -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234616] New: git pull sometimes deletes folder contents
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234616 Bug ID: 1234616 Summary: git pull sometimes deletes folder contents Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jshand2013(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 879175 --> https://bugzilla.suse.com/attachment.cgi?id=879175&action=edit full debug info i have a script that runs alot of git pulls and noticed that one of them magically lost its contents. However, when i checked that folder with hidden files in view, they seemed to be intact. i have enclosed all debug info needed hopefully -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1228863] System asking for recovery key while booting a default mode encrypted Aeon system after automatic update
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1228863 https://bugzilla.suse.com/show_bug.cgi?id=1228863#c67 Guillermo Perez <guillermopf10(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(happymab.dev@outl | |ook.com) | Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #67 from Guillermo Perez <guillermopf10(a)gmail.com> --- (In reply to Alberto Planas Dominguez from comment #66) > (In reply to Guillermo Perez from comment #65) > > > but it would be nice if, for some next uodate, the echo > > for the recovery key wouldn't be obscured > > sdbootutil print the recovery key in the terminal, together with the QR > code. Or do you mean in some part of the Aeon installer? > > In any case your system can be recovered. It should work now with > `sdbootutil enroll --method=tpm2` I tried to enroll again with the method you provided and yes, it worked, saved me an headache, now it boots normaly. As for the obscured recovery key I mean when the OS asks for it on boot. It's a very long key and the echo on screen is just dots, which makes very difficult to know if you are making a typo. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234483] New: VUL-0: : restic: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234483 Bug ID: 1234483 Summary: VUL-0: : restic: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/432234/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: herbert(a)graeber-clan.de Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1234482 Target Milestone: --- Found By: --- Blocker: --- Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45337 https://www.cve.org/CVERecord?id=CVE-2024-45337 https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb… https://go.dev/cl/635315 https://go.dev/issue/70779 https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ https://pkg.go.dev/vuln/GO-2024-3321 http://www.openwall.com/lists/oss-security/2024/12/11/2 https://bugzilla.redhat.com/show_bug.cgi?id=2331720 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 4