February 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1219487] New: VUL-0: CVE-2021-4435: yarn: untrusted search path
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1219487 Bug ID: 1219487 Summary: VUL-0: CVE-2021-4435: yarn: untrusted search path Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/392751/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-4435 https://bugzilla.redhat.com/show_bug.cgi?id=2262284 Patch: https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef52… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1217047] Tracker: Packages incompatible with appstream 1.0
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1217047 Yifan Jiang <yfjiang(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |yfjiang(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219242] New: [Build 20240125] openQA test fails in fallocate06
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1219242 Bug ID: 1219242 Summary: [Build 20240125] openQA test fails in fallocate06 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3895229/modules/fall ocate06/steps/6 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation There wasn't a kernel update today but this LTP test started failing in different workers: ----snip---- # wait_serial expected: qr/### TEST fallocate06 COMPLETE >>> \d+\./u # Result: tst_device.c:293: TWARN: Failed to create test_dev.img: ENOSPC (28) tst_device.c:354: TBROK: Failed to acquire device HINT: You _MAY_ be missing kernel fixes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… Summary: passed 0 failed 0 broken 1 skipped 0 warnings 1 ### TEST fallocate06 COMPLETE >>> 6. ----snip---- openQA test in scenario opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-ltp-syscalls@uefi_virtio-2G fails in [fallocate06](https://openqa.opensuse.org/tests/3895229/modules/fallocate06/… ## Test suite description ## Reproducible Fails since (at least) Build [20240123](https://openqa.opensuse.org/tests/3888826) ## Expected result Last good: [20240122](https://openqa.opensuse.org/tests/3886452) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1217417] Realtek RTL-8126 Network Driver
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1217417 https://bugzilla.suse.com/show_bug.cgi?id=1217417#c35 --- Comment #35 from Takashi Iwai <tiwai(a)suse.com> --- Now the two proper patches have been submitted to the upstream, I backported them to stable branch (and SLE15-SP6 branch for Leap 15.6). https://lore.kernel.org/r/c2eaaf79-600a-4162-b439-8dbd7e7033fd@gmail.com https://lore.kernel.org/r/0c8e67ea-6505-43d1-bd51-94e7ecd6e222@gmail.com For TW, it'll be likely included in 6.7.4 update kernel. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219469] New: VUL-0: CVE-2024-21485: python-dash-core-components: XSS in 'dash-core-components
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1219469 Bug ID: 1219469 Summary: VUL-0: CVE-2024-21485: python-dash-core-components: XSS in 'dash-core-components Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/392840/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server. **Note:** This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21485 https://security.snyk.io/vuln/SNYK-PYTHON-DASH-6226335 https://security.snyk.io/vuln/SNYK-PYTHON-DASHCORECOMPONENTS-6226334 https://security.snyk.io/vuln/SNYK-PYTHON-DASHHTMLCOMPONENTS-6226336 https://www.cve.org/CVERecord?id=CVE-2024-21485 https://github.com/plotly/dash/commit/9920073c9a8619ae8f90fcec1924f2f3a4332… https://github.com/plotly/dash/issues/2729 https://github.com/plotly/dash/pull/2732 https://github.com/plotly/dash/releases/tag/v2.15.0 https://security.snyk.io/vuln/SNYK-JS-DASHCORECOMPONENTS-6183084 https://security.snyk.io/vuln/SNYK-JS-DASHHTMLCOMPONENTS-6226337 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1218578] Unable to install OpenMW due to missing dependencies
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1218578 https://bugzilla.suse.com/show_bug.cgi?id=1218578#c22 --- Comment #22 from Jimis Hol <hol.jimis(a)gmail.com> --- I asked for help from IRC: #openmw on irc.libera.chat It was suggested that nobody looked for OGRE nearly a decade. Unless it is used in background and unfortunately it was forgotten by anyone, it was suggested to use mygui 3.4.2 instead and get rid of OGRE. Can you try it? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219448] python310-ypy-websocket-0.12.4-1.1.noarch erfordert '(python310-y-py >= 0.6 with python310-y-py < 0.7)', but this request cannot be provided
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1219448 https://bugzilla.suse.com/show_bug.cgi?id=1219448#c1 Steve Kowalik <steven.kowalik(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |steven.kowalik(a)suse.com Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #1 from Steve Kowalik <steven.kowalik(a)suse.com> --- Sorry, that package is actually in the process of being removed from Factory, it's replacement is python-pycrdt-websocket. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219462] New: Unable to boot when lvm raidintegrity is enabled
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1219462 Bug ID: 1219462 Summary: Unable to boot when lvm raidintegrity is enabled Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: william.brown(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 872386 --> https://bugzilla.suse.com/attachment.cgi?id=872386&action=edit screenshot of grub errors If a raid 1 lvm volume is configure with raidintegrity enable, grub is unable to boot with the error: "unknown node 'root_rimage_0'" Reproducer: Install tumbleweed in a VM with LVM for root + swap. Resize the VM disk to allow space for the integrity image. Add another virtual disk of the same size. copy the partition table from vda to vdb # sgdisk -R /dev/vdb /dev/vda reset vdb's GUID # sgdisk -G /dev/vdb Create a PV on vdb2 # pvcreate /dev/vdb2 Add vdb2 to the vg #vgextend system /dev/vdb2 Convert the root lv to raid 1 # lvconvert --type raid1 system/root wait for the sync to complete # lvs -a -o +devices LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert Devices root system rwi-aor--- 18.62g 100.00 root_rimage_0(0),root_rimage_1(0) [root_rimage_0] system iwi-aor--- 18.62g /dev/vda2(351) [root_rimage_1] system iwi-aor--- 18.62g /dev/vdb2(1) [root_rmeta_0] system ewi-aor--- 4.00m /dev/vda2(5117) [root_rmeta_1] system ewi-aor--- 4.00m /dev/vdb2(0) swap system -wi-ao---- 1.37g /dev/vda2(0) Reboot to demonstrate that raid1 is bootable. # reboot Add raidintegrity # lvconvert --raidintegrity y system/root Wait for the sync to complete # lvs -a -o +devices LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert Devices root system rwi-aor--- 18.62g 100.00 root_rimage_0(0),root_rimage_1(0) [root_rimage_0] system gwi-aor--- 18.62g [root_rimage_0_iorig] 100.00 root_rimage_0_iorig(0) [root_rimage_0_imeta] system ewi-ao---- 220.00m /dev/vda2(5118) [root_rimage_0_iorig] system -wi-ao---- 18.62g /dev/vda2(351) [root_rimage_1] system gwi-aor--- 18.62g [root_rimage_1_iorig] 100.00 root_rimage_1_iorig(0) [root_rimage_1_imeta] system ewi-ao---- 220.00m /dev/vdb2(4767) [root_rimage_1_iorig] system -wi-ao---- 18.62g /dev/vdb2(1) [root_rmeta_0] system ewi-aor--- 4.00m /dev/vda2(5117) [root_rmeta_1] system ewi-aor--- 4.00m /dev/vdb2(0) swap system -wi-ao---- 1.37g /dev/vda2(0) Reboot -- Expected Behaviour System boots normally. -- Actual Behaviour Grub errors and the system is unbootable. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1216842] Firefox all tabs list issues on KDE Wayland - cannot move tabs in list
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1216842 https://bugzilla.suse.com/show_bug.cgi?id=1216842#c8 pallas wept <pallaswept(a)proton.me> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |qa-bugs(a)suse.de Flags| |needinfo?(qa-bugs(a)suse.de) --- Comment #8 from pallas wept <pallaswept(a)proton.me> --- (In reply to pallas wept from comment #7) > It's been 5 months and I haven't heard a word, except from you telling me it > could not be reproduced Which I do appreciate, by the way, since as far as I'm aware (which doesn't make it a fact, but the fact is that it is all I am aware of), your few minutes testing this are the only time or effort invested even attempting to look into this in the entire 5 months. So at least I know that you *tried* - so thanks for that. But I gave you those reproduction processes to bypass my machine as a factor, and you went silent. You were my only hope, and now I have none. I feel like there is an off-the-record agreement that nobody will look into my issues and they will all be resolved as duplicates of this bug to be ignored forever, because I am new to bugzilla and filed my first two cases according to outdated documentation of how to file them, and because I did it wrong, and presented a difficult issue, I have become an annoyance and must be punished for eternity. This really sucks, and it isn't a cool way to treat people. I respect that you are all busy, but 5 months without a word goes beyond "I'm busy" to "I'm deliberately ignoring you". I've re-opened the other case because it is NOT a duplicate of this one, it's a separate bug filed against a separate project, intentionally, and since you are not talking to me, and nobody is, no reason has been given by anyone to suggest that there is any reason to close that one. If anything, from a technical perspective (since the issue DOES exist in plasma wayland, and also NOT in suse's firefox package), closing this bug as a duplicate of that one, seems to make more sense at the moment. Since you obviously have no desire or intention to interact with me, perhaps doing that and leaving it to another team might suit you better, too. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219329] New: Firefox all tabs list issues on KDE Wayland - cannot move tabs in list
by bugzilla_noreply＠suse.com 02 Feb '24

02 Feb '24

https://bugzilla.suse.com/show_bug.cgi?id=1219329 Bug ID: 1219329 Summary: Firefox all tabs list issues on KDE Wayland - cannot move tabs in list Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: pallaswept(a)proton.me QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Short version: In Firefox, in KDE Plasma Wayland sessions on Tumbleweed, you cannot move tabs (by drag'n'drop with the mouse) in the all tabs list (the one you get when you press ctrl+shift+tab) - unless that list is longer than the window is in height. Process for reproduction of the fault on an entirely unmodified system: Obtain the latest Tumbleweed Live ISO and boot to it in a VM (or bare metal if you prefer) for testing. Log out (because it automatically logs into X11) and log in (to Plasma Wayland), start firefox, hit ctrl+t several times to create new tabs, press ctrl+shift+tab to open the all tabs list, click on one of the tabs and try to drag it, and it will fail. To observe the intended behaviour, resize the window (make it shorter) and create more tabs, until the all tabs list becomes longer than the height of the window, then repeat the process, and you will see a blue marker appear as you drag the tab, showing where it would be moved to, and releasing the mouse button will move the tab to that position. Alternatively, just try it in a Plasma X11 session, where it works fine, or a Plasma Wayland session in a different distro, where it will also work. I've had this bug filed against Firefox, but I'm now filing this against KDE Plasma because I've found that the issue also exists with the nightly Firefox, as downloaded directly from Mozilla, and not packaged by openSUSE, but it only occurs in KDE Plasma Wayland sessions and only on Tumbleweed (KDE Plasma Wayland sessions on Ubuntu and Neon live ISOs worked OK, for example, and KDE X11 on Tumbleweed was fine, too) so, Tumbleweed KDE Plasma Wayland seems to be the critical factor in this failure. I'm unsure as to whether to mark the other bug as a duplicate and close it, as I have had no word from the maintainers of that package, so I'm not entirely sure what the cause of the problem is, Plasma Wayland, or Firefox, so I don't know which of these cases should be left open. I'll be sure to clean up whenever things become clear. It would be really nice to get some help with this. As a disabled user, this is causing me some degree of physical pain, and it's been 5 months without response so far, I don't think it's normal to have a bug left unattended for such a long time? Hopefully this package's maintainers will be willing to help me.... Please! :) -- You are receiving this mail because: You are on the CC list for the bug.

1 1