February 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1218678] New: VUL-0: CVE-2022-36763: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of co ...
by bugzilla_noreply＠suse.com 26 Apr '24

26 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218678 Bug ID: 1218678 Summary: VUL-0: CVE-2022-36763: EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of co ... Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/390488/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-36763 https://www.cve.org/CVERecord?id=CVE-2022-36763 https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1218680] New: VUL-0: CVE-2022-36765: EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise ...
by bugzilla_noreply＠suse.com 26 Apr '24

26 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218680 Bug ID: 1218680 Summary: VUL-0: CVE-2022-36765: EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise ... Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/390490/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-36765 https://www.cve.org/CVERecord?id=CVE-2022-36765 https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1218887] New: VUL-0: CVE-2023-45237: edk2, ovmf: Use of a Weak PseudoRandom Number Generator
by bugzilla_noreply＠suse.com 25 Apr '24

25 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218887 Bug ID: 1218887 Summary: VUL-0: CVE-2023-45237: edk2, ovmf: Use of a Weak PseudoRandom Number Generator Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/391385/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: guillaume.gardet(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45237 https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h https://www.cve.org/CVERecord?id=CVE-2023-45237 http://www.openwall.com/lists/oss-security/2024/01/16/2 https://bugzilla.redhat.com/show_bug.cgi?id=2258706 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1219531] New: [Build 20240202] openQA test fails in znc
by bugzilla_noreply＠suse.com 25 Apr '24

25 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1219531 Bug ID: 1219531 Summary: [Build 20240202] openQA test fails in znc Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3913497/modules/znc/ steps/4 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation The introduction of rpm 4.19 resulted in this error Any package that declares special owner on files get an automatic dependency on the respective user/group. If said user/group are generated by means of Stausees.d, the provides are automatically added by rpm. In case the user is manually created using add user/add group in a pre script, the capability needs to be manually advertised using provides: user(username) Provides: group(group name) Preferably the packages are converted to sysusers to generate the user, but manually adding the provides is a valid stop-measure. openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in [znc](https://openqa.opensuse.org/tests/3913497/modules/znc/steps/4) ## Test suite description Maintainer: slindomansilla(a)suse.de. Mainly post-installation console extra tests. ## Reproducible Fails since (at least) Build [20240131](https://openqa.opensuse.org/tests/3908402) ## Expected result Last good: [20240130](https://openqa.opensuse.org/tests/3905084) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1220524] New: Files in virtualbox shared folder (on the guest) show wrong timestamp
by bugzilla_noreply＠suse.com 24 Apr '24

24 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1220524 Bug ID: 1220524 Summary: Files in virtualbox shared folder (on the guest) show wrong timestamp Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: suse.junky(a)t-online.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On my openSUSE Tumbleweed system (bare metal) Operating System: openSUSE Tumbleweed 20240225 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.115.0 Qt Version: 5.15.12 Kernel Version: 6.7.6-1-default (64-bit) Graphics Platform: X11 I use virtualbox # zypper se -si virtual* Loading repository data... Reading installed packages... S | Name | Type | Version | Arch | Repository ---+------------------------+---------+-----------------------+--------+------------------ i | virtualbox | package | 7.0.14-3.1 | x86_64 | (System Packages) i+ | virtualbox-kmp-default | package | 7.0.14_k6.7.6_1-3.2 | x86_64 | (System Packages) i+ | virtualbox-qt | package | 7.0.14-3.1 | x86_64 | (System Packages) # One guest is an openSUSE Tumbleweed 20240225 system with # zypper se -si virtualbox* Loading repository data... Reading installed packages... S | Name | Type | Version | Arch | Repository ---+------------------------+---------+---------------------+--------+------------------ i+ | virtualbox-guest-tools | package | 7.0.14-3.1 | x86_64 | (System Packages) i+ | virtualbox-kmp-default | package | 7.0.14_k6.7.6_1-3.2 | x86_64 | (System Packages) # The host shares a directory (/mnt/Lokal/VM_share) with the guest. On the host system I have (in my home directory) a file > ls -la *.jpg -rw-r--r-- 1 A users 40749 Mar 3 2023 Opensuse_beer_label.jpg when I copy this file to the shared directory > cp -a Opensuse_beer_label.jpg /mnt/Lokal/VM_share/ everything looks fine (on the host) > ls -la /mnt/Lokal/VM_share/ total 64 drwxr-xr-x 3 A users 4096 Feb 27 09:51 . drwxr-xr-x 7 root root 4096 Jan 3 2022 .. -rw-r--r-- 1 A users 40749 Mar 3 2023 Opensuse_beer_label.jpg > but on the guest system I see in the shared folder > ls -la total 64 drwxrwx--- 1 root vboxsf 4096 Jan 1 1970 . dr-xr-xr-x 5 root root 4096 Feb 27 09:40 .. -rwxrwx--- 1 root vboxsf 40749 Feb 27 09:44 Opensuse_beer_label.jpg > The timestamps in the share of the VM don’t make sense to me. This happens to all files copied to the share. Even when I copy files in the guest to the share their timestamps are changed (in the share) to the current date . However when I look at those files on the host they do have the correct date; i.e. the date of the original file in the guest. On MS Windows 11 (bare metal) with virtualbox 7.0.14 and openSUSE Tumbleweed 20240225 as guest I see the same behaviour. Kubuntu (as guest) does not show this behaviour although it uses VBoxGuestAdditions_7.0.14 as well. I discussed this already here: https://forums.opensuse.org/t/files-in-the-virtualbox-share-show-wrong-time… and a third user could very this behaviour in its setup as well. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1218158] New: yast-nfs-server hardcoded configuration file /etc/idmapd.conf
by bugzilla_noreply＠suse.com 23 Apr '24

23 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1218158 Bug ID: 1218158 Summary: yast-nfs-server hardcoded configuration file /etc/idmapd.conf Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- nfs-client has moved its default configuration files from /etc to /usr/etc yast-nfs-server is expecting to find the default file at /etc/idmapd.conf see: https://github.com/yast/yast-nfs-server/blob/a7714580ccd9c6e2e4acdc62c4e0dd… and it fails, you can see it in this test: https://openqa.opensuse.org/tests/3819034#step/yast2_nfs_server/28 For reference, see: https://bugzilla.opensuse.org/show_bug.cgi?id=1216740 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1217488] New: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY
by bugzilla_noreply＠suse.com 23 Apr '24

23 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1217488 Bug ID: 1217488 Summary: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Filesystems Assignee: nfbrown(a)suse.com Reporter: petr.vorel(a)suse.com QA Contact: petr.vorel(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Although we start due #1217128 testing via cdmackay/pynfs.git, which has fix for "nfs4lib.BadCompoundRes: operation OP_SETCLIENTID should return NFS4_OK [1], instead got NFS4ERR_DELAY", we still get 9 tests failing with this error on Tumbleweed. Any idea what could be wrong now? O I can ask Calum Mackay on linux-nfs if you're busy with more important stuff. [1] https://git.linux-nfs.org/?p=cdmackay/pynfs.git;a=commit;h=0d4d3fd0bb7a6386… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1220195] New: Embedded Perl Interpreter Messes up Locale Environment of Calling Process
by bugzilla_noreply＠suse.com 23 Apr '24

23 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1220195 Bug ID: 1220195 Summary: Embedded Perl Interpreter Messes up Locale Environment of Calling Process Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: shundhammer(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since about the summer of 2023, the Perl version that comes with Tumbleweed changes the locale environment of a process initializing an embedded Perl interpreter to use only 7-bit ASCII (encoding "ANSI_X3.4-1968"), so special characters in languages like Japanese, German, Czech (and probably many more) are broken: They are replaced by a question mark '?' each. This affects GNU gettext translations as well as file output. We experienced this in YaST, where it was reported as bug #1216689, and it was only after months of investigation and about 100 comments in Bugzilla that we found the cause. In our case, the symptom was that messages from libstorage-ng and from Perl modules had broken special characters, but those from our embedded Ruby, from the Qt UI and from the NCurses UI were correct. We finally found a workaround that appears to work for us: After initializing the embedded Perl interpreter, we are now switching back to the global locale with uselocale( LC_GLOBAL_LOCALE ); For a summary and some screenshots, see the PR with this fix: https://github.com/yast/yast-perl-bindings/pull/31 More details at the original bug #1216689. We found that there was a major difference in the Perl source code's locale.c between the versions we have in Leap 15.5 and recent Tumbleweed. We could roughly it down to sometime between perl-5.26.1 (Leap 15.5) not showing the problem and perl-38.2 (TW from 02/2024) where it definitely appears, probably perl-36 as well. The perl change log says they improved the locale handling for multi-threading; that might be where this started. We are not sure if this is an issue for just using Perl in the regular mode (not as an embedded interpreter); we had the symptoms in our Perl code using GNU gettext translations as well. I will attach some minimalistic test programs for easier investigation. -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1216740] New: nfs-client: move config to /usr
by bugzilla_noreply＠suse.com 22 Apr '24

22 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1216740 Bug ID: 1216740 Summary: nfs-client: move config to /usr Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: nfbrown(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- nfs-client ships several (sample) config files in /etc. Those should be removed nowadays. Just package the samples as %doc. The relevant ones should be shipped in /usr (e.g /usr/etc) instead. Bonus points for also supporting drop-ins. See also tracker bug 1208319 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1219494] New: libmfx no longer supported
by bugzilla_noreply＠suse.com 22 Apr '24

22 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1219494 Bug ID: 1219494 Summary: libmfx no longer supported Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: sndirsch(a)suse.com QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- libmfx is no longer supported https://github.com/Intel-Media-SDK/MediaSDK DISCONTINUATION OF PROJECT. This project will no longer be maintained by Intel. This project has been identified as having known security escapes. Intel has ceased development and contributions including, but not limited to, maintenance, bug and security fixes, new releases, or updates, to this project. Intel no longer accepts patches to this project. If you have an ongoing need to use this project, are interested in independently developing it, or would like to maintain patches for the open source software community, please create your own fork of this project. [...] Let's get rid of it, i.e. remove the support from the following affected packages libavfilter7_110 libavutil56_70 libavcodec58_134 --> ffmpeg-4 vlc-noX --> vlc libavfilter8 libavutil57 libavcodec59 --> ffmpeg-5 gstreamer-plugins-bad --> gstreamer-plugins-bad Then drop libmfx package (includes libmfx-samples subpackage). -- You are receiving this mail because: You are on the CC list for the bug.

1 29