April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1219879] New: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0
by bugzilla_noreply＠suse.com 25 Jan '25

25 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1219879 Bug ID: 1219879 Summary: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: otto.hollmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This bug collects the challenges and packages that need to be adapted before removing OpenSSL 1.1.1 and OpenSSL 1.0.0 OpenSSL 1.1.1 (package openssl1_1) is EOL since 11th September 2023. OpenSSL 1.0.0 (package openssl1_0_0) is EOL since 31th December 2019. Therefore, it makes sense to get rid of them and we are going to remove them from Factory in the near future. Unfortunately some packages still rely/depend on these old OpenSSL versions. If we would like to keep these packages, they must be adapted to use OpenSSL 3. Currently these packages are usually hardcoded to use specific openssl package, e.g.: > BuildRequires: libopenssl-1_1-devel The preferred way is to use our meta package > BuildRequires: libopenssl or > BuildRequires: libopenssl-devel that will always pull respective packages with the default OpenSSL version (at the moment libopenssl3 or libopenssl-3-devel). Migration guide can be found here: https://www.openssl.org/docs/man3.0/man7/migration_guide.html List of packages that are using old OpenSSL: dd_rescue EternalTerminal fdo-client libredfish libzrtpcpp python -- You are receiving this mail because: You are on the CC list for the bug.

1 23

[Bug 1218653] New: Gimp 3 scheduled for May - Lets start the preparations
by bugzilla_noreply＠suse.com 24 Jan '25

24 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1218653 Bug ID: 1218653 Summary: Gimp 3 scheduled for May - Lets start the preparations Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- - https://www.phoronix.com/news/GIMP-3.0-May-2024-Schedule - https://librearts.org/2023/11/gimp-3-0-roadmap/ current test packages are in: https://build.opensuse.org/project/show/graphics:gimp:master i dropped a mail to Jehan to find out if the master snapshots of gegl and babl are still needed or not. if we want to have parallel buildable packages it would be easy to rename the master gimp package to gimp3 and apply this patch: ``` Index: gimp.spec =================================================================== --- gimp.spec (revision 1878) +++ gimp.spec (working copy) @@ -67,14 +67,16 @@ %global abiver 5 %global apiver 3.0 -Name: gimp +%define pkg_name gimp + +Name: gimp3 Version: 3.0 Release: 0 Summary: The GNU Image Manipulation Program License: GPL-3.0-or-later Group: Productivity/Graphics/Bitmap Editors URL: https://www.gimp.org/ -Source: %{name}-%{version}.tar.zst +Source: %{pkg_name}-%{version}.tar.zst Source1: macros.gimp # openSUSE palette file Source2: openSUSE.gpl @@ -184,6 +186,7 @@ Provides: gimp-2.0 = %{version} Provides: gimp(abi) = %{abiver} Provides: gimp(api) = %{apiver} +Conflicts: gimp %description The GIMP is an image composition and editing program, which can be @@ -296,7 +299,7 @@ %endif %prep -%autosetup -p1 +%autosetup -p1 -n %{pkg_name}-%{version} %build #define _lto_cflags %{nil} ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 31

[Bug 1218424] New: go1.22 release tracking
by bugzilla_noreply＠suse.com 24 Jan '25

24 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1218424 Bug ID: 1218424 Summary: go1.22 release tracking Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- go1.22 (expected February 2024) is a major release of Go. Minor releases of go1.22.x will be provided through February 2025. This issue tracks go1.22.x releases packaged and submitted initially to openSUSE:Factory and can be referenced in submissions to additional repositories. Go Release Cycle https://github.com/golang/go/wiki/Go-Release-Cycle Go Release history https://golang.org/doc/devel/release.html -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1216739] New: sssd: support configs and drop-ins in /usr
by bugzilla_noreply＠suse.com 21 Jan '25

21 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1216739 Bug ID: 1216739 Summary: sssd: support configs and drop-ins in /usr Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: scabrero(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de CC: ckowalczyk(a)suse.com, jengelh(a)inai.de, scabrero(a)suse.com Target Milestone: --- Found By: --- Blocker: --- sssd ships configs in /etc. In order to be able to ship configs as packages, support for having configs in /usr is desireable as well. Any chance to simplement /usr/etc support? -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1221429] New: Presence dialog for ssh id_ed25519_sk keys not showing up
by bugzilla_noreply＠suse.com 21 Jan '25

21 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1221429 Bug ID: 1221429 Summary: Presence dialog for ssh id_ed25519_sk keys not showing up Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: felix.niederwanger(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When logging in via ssh using a id_ed25519_sk key (e.g. Yubikey), typically ssh prompts a dialog, prompting the user to push the presence key on the hardware dongle. In Plasma6 when doing ssh against a host that requires this presence button to be pushed, the dialog does not show up. The login still works, ssh just blocks and when I push the button it works, but the confirmation dialog does not show up anymore. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1222473] New: VUL-0: CVE-2024-22189: dnscrypt-proxy: quic-go: memory exhaustion attack against QUIC's connection ID mechanism
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1222473 Bug ID: 1222473 Summary: VUL-0: CVE-2024-22189: dnscrypt-proxy: quic-go: memory exhaustion attack against QUIC's connection ID mechanism Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/400376/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: cunix(a)mail.de Reporter: camila.matos(a)suse.com QA Contact: qa-bugs(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1222461 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1222461 +++ quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22189 https://www.cve.org/CVERecord?id=CVE-2024-22189 https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c… https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478 https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-manageme… https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683s https://bugzilla.redhat.com/show_bug.cgi?id=2273513 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1222505] New: ckermit: cannot create lock file in /var/lock
by bugzilla_noreply＠suse.com 17 Jan '25

17 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1222505 Bug ID: 1222505 Summary: ckermit: cannot create lock file in /var/lock Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: ceggers(a)arri.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Kermit needs to create a lock file for the used serial port (e.g. /dev/ttyUSB0) under /var/lock (symlink to /run/lock). Until Leap 15.5, that directory was owned by group "lock", so it was sufficient to add the current user to the "lock" group. But now the directory is owned by group "root", so using the "lock" group is not sufficient anymore. Reproducible: Always Steps to Reproduce: 1. Add current user to "dialout" group (and create re-login after that). 2. Ensure that step 1. was successful (e.g. by using the "id" command). 3. kermit -l /dev/ttyUSB0 Actual Results: Kermit gives an error "can't open device". Using "set line /dev/ttyUSB0" in kermit's interactive mode gives a more precise error message: "Sorry, write access to UUCP lockfile directory denied." Expected Results: kermit should have created the lock file and open /dev/ttyUSB0 A workaround is to change the group of /run/lock to "dialout" (and to add the current user to this group). But this change is lost after every reboot. Possibly related to https://bugzilla.opensuse.org/show_bug.cgi?id=624290 ("ckermit from contrib repository does not use lockdev, so cannot write to /var/lock"). The packet installed is: $ rpm -q ckermit --info Name : ckermit Version : 9.0.302 Release : 150000.3.3.1 Architecture: x86_64 Install Date: Mo 08 Apr 2024 09:44:42 CEST Group : Hardware/Modem Size : 2621762 License : BSD-3-Clause Signature : RSA/SHA256, Fr 01 Apr 2022 13:39:36 CEST, Key ID 70af9e8139db7c82 Source RPM : ckermit-9.0.302-150000.3.3.1.src.rpm Build Date : Fr 01 Apr 2022 13:39:14 CEST Build Host : goat10 Relocations : (not relocatable) Packager : https://www.suse.com/ Vendor : SUSE LLC <https://www.suse.com/> URL : http://www.kermitproject.org/ Summary : A Combined Serial and Network Communication Software Package Description : C-Kermit is a combined serial and network communication software package offering a consistent, medium-independent, and cross-platform approach to connection establishment, terminal sessions, file transfer, character-set translation, and automation of communication tasks. Distribution: SUSE Linux Enterprise 15 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223420] New: VUL-0: CVE-2024-31755: cJSON: NULL pointer dereference via cJSON_SetValuestring()
by bugzilla_noreply＠suse.com 15 Jan '25

15 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1223420 Bug ID: 1223420 Summary: VUL-0: CVE-2024-31755: cJSON: NULL pointer dereference via cJSON_SetValuestring() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/403222/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mardnh(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-31755 https://www.cve.org/CVERecord?id=CVE-2024-31755 https://github.com/DaveGamble/cJSON/issues/839 https://bugzilla.redhat.com/show_bug.cgi?id=2277268 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1221095] New: Go application packages can no longer set CGO_ENABLED=0 if external linker will be used
by bugzilla_noreply＠suse.com 14 Jan '25

14 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1221095 Bug ID: 1221095 Summary: Go application packages can no longer set CGO_ENABLED=0 if external linker will be used Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Per Go upstream change https://go-review.googlesource.com/c/website/+/569296, as of go1.21.8+ and go1.22.1+ go build commands cannot set CGO_ENABLED=0 if the external linker will be used. (Cgo lets Go packages call C code, see https://go.dev/blog/cgo, 2011) The most commonly used option that triggers the external linker is -buildmode=pie, which we aspirationally use in most Go application packages behind conditionals for architectures where it is unsupported, currently only ppc64le. We first encountered this issue when trying to set the go metapackage from go1.21 to go1.22. Approximately 40+ Go application packages in Factory set CGO_ENABLED=0 and -buildmode=pie together. On arch i586, builds started to fail with error: -buildmode=pie requires external (cgo) linking, but cgo is not enabled This tracking bug will be referenced for SR submissions to Go application packages to adapt to the new requirements. Most of these submissions will to remove CGO_ENABLED=0 absent a requirement for its use by a specific package. Upstream comments from the above change: https://go.dev/issue/31544, CL 477839 When using an external (C) linker with cgo enabled, the `runtime/cgo` package is now supplied to the Go linker as an additional dependency to ensure that the Go runtime is compatible with any additional libraries added by the C linker. https://go.dev/issue/46330, CL 522239 go build commands that invoke the linker now error out if an external (C) linker will be used but cgo is not enabled. (The Go runtime requires cgo support to ensure that it is compatible with any additional libraries added by the C linker.) -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1220086] New: xfce4-terminal does not honor --geometry parameter under wayland
by bugzilla_noreply＠suse.com 09 Jan '25

09 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1220086 Bug ID: 1220086 Summary: xfce4-terminal does not honor --geometry parameter under wayland Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: i686 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: opensuse(a)mike.franken.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I decided to play around with wayland instead of x11 to find out, if everything works as expected for me. On thing I found, is that xfce4-terminal does not honor --geometry parameter under wayland. It is always started centered, it seems to use the size parameters, though. Operating System: openSUSE Tumbleweed 20240216 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.115.0 Qt Version: 5.15.12 Kernel Version: 6.7.4-1-default (64-bit) Graphics Platform: Wayland Processors: 8 × 11th Gen Intel® Core™ i7-1165G7 @ 2.80GHz Memory: 15,0 GiB of RAM Graphics Processor: Mesa Intel® Xe Graphics Manufacturer: Dell Inc. Product Name: XPS 13 9310 2-in-1 -- You are receiving this mail because: You are on the CC list for the bug.

1 3