April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1219562] New: zypper dup killed zypper: can't open librpm.so.9
by bugzilla_noreply＠suse.com 15 Jul '24

15 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1219562 Bug ID: 1219562 Summary: zypper dup killed zypper: can't open librpm.so.9 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)suse.de Reporter: shundhammer(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After not updating my TW VM for two weeks (last zypper dup: 2024-01-17), today's 'zypper dup' destroyed the package management stack: (all commands entered as root) # zypper dup -y --download-only (worked without any problem, downloaded 3181 packages) # zypper dup -y ( 330/3181) Installing: openssl-3-3.1.4-3.2.x86_64 ...........................................................................................[error] Installation of openssl-3-3.1.4-3.2.x86_64 failed: Error: Subprocess failed. Error: RPM failed: Command exited with status 1. Abort, retry, ignore? [a/r/i] (a): a Warning: %posttrans and %transfiletrigger scripts are not executed when aborting! Problem occurred during or after installation or removal of packages: Installation has been aborted as directed. Please see the above error message for a hint. # zypper dup -y zypper: error while loading shared libraries: librpm.so.9: cannot open shared object file: No such file or directory # ldconfig # zypper dup -y zypper: error while loading shared libraries: librpm.so.9: cannot open shared object file: No such file or directory -- You are receiving this mail because: You are on the CC list for the bug.

1 25

[Bug 1221322] New: cannot open yast software management app, caller yast.rb:186:in `import_pure'
by bugzilla_noreply＠suse.com 14 Jul '24

14 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221322 Bug ID: 1221322 Summary: cannot open yast software management app, caller yast.rb:186:in `import_pure' Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Ruby Assignee: ruby-devel(a)suse.de Reporter: canalcheferaser(a)tutanota.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 873462 --> https://bugzilla.suse.com/attachment.cgi?id=873462&action=edit y2log when trying to open yast software management app i get this error: ` Internal error. Please report a bug report with logs. Run save_y2logs to get complete logs. Caller: /usr/lib64/ruby/vendor_ruby/3.3.0/yast/yast.rb:186:in `import_pure' Details: component cannot import namespace 'Pkg' ` I attached the log. Also "sudo zypper dup" doesnt work, with error: ` sudo zypper dup [sudo] password for root: zypper: error while loading shared libraries: libabsl_log_internal_check_op.so.2308.0.0: cannot open shared object file: No such file or directory ` Restarting does not help. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1222019] New: krdc can not connect to VNC hosts in plasma 6
by bugzilla_noreply＠suse.com 13 Jul '24

13 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222019 Bug ID: 1222019 Summary: krdc can not connect to VNC hosts in plasma 6 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: noreply.section+dev(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After upgrading to Plasma 6, krdc can not connect to VNC hosts anymore. When trying to connect, krdc goes straight to a blue screen. After that, if trying to disconnect, the program freezes and the only way out is to kill the application. The behavior is the same regardless of what string is typed in the address field: i.e. the lock must happen quite early in the program. This still happens in tw 20240325 with krdc 24.02.1. A workaround so far is to use an alternative VNC viewer, such as tigervnc. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1222875] New: ghostwriter crash on start
by bugzilla_noreply＠suse.com 13 Jul '24

13 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222875 Bug ID: 1222875 Summary: ghostwriter crash on start Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: hol.jimis(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I can not tell from what tumbleweed update it started not working but version 24.02.1-1.3 crashes with segmentation fault (core dumped) ghostwriter The only output I have is Command "pandoc" is not available. Command "multimarkdown" is not available. Command "cmark" is not available. [1] 12170 segmentation fault (core dumped) ghostwriter I installed pandoc, it finds it ok, but the crash seems irrelevant to previous output. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1222442] New: [20240404] Xorg crash running Android studio
by bugzilla_noreply＠suse.com 12 Jul '24

12 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222442 Bug ID: 1222442 Summary: [20240404] Xorg crash running Android studio Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: pujos.michael(a)gmail.com QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since snapshot 20240404 and upgrade of xorg-x11-server (21.1.11 -> 21.1.12), starting Android Studio crashes Xorg hard everytime. Most specifically, I am using Android Studio Koala | 2024.1.1 Canary 3 that can be downloaded here: https://developer.android.com/studio/preview. I would not be surprised this crash happens with other Jetbrains IDE but I have not tried. I triggered 2 crashes, both of which killed the Xorg process. There first crash had a crash stack in journalctl why the other did not: Apr 08 10:06:11 p72 systemd-coredump[16070]: [🡕] Process 11338 (Xorg.bin) of user 1000 dumped core. Stack trace of thread 11338: #0 0x00007f63b22949ec __pthread_kill_implementation (libc.so.6 + 0x949ec) #1 0x00007f63b2241176 raise (libc.so.6 + 0x41176) #2 0x00007f63b2228917 abort (libc.so.6 + 0x28917) #3 0x0000555e1e464efc n/a (/usr/bin/Xorg.bin + 0x1dbefc) #4 0x00007ffee9bf4ba0 n/a (n/a + 0x0) ELF object binary architecture: AMD x86-64 Reverting to 21.1.11 fixes that issue and I have added a lock for package xorg-x11-server for the time being. -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1221085] New: encfs segfaults
by bugzilla_noreply＠suse.com 12 Jul '24

12 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221085 Bug ID: 1221085 Summary: encfs segfaults Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: tiwai(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After upgrading from leap 15.5 to 15.6, mounting via encfs causes a segfault. Reverting back to leap 15.5 package fixed. My understanding is that this happens because we now build with openssl3 while it was openssl1 in leap 15.5. When I rebuild the package with libopenssl-1_1-devel instead of openssl-devel, it starts working. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223336] New: openssl-3: variations in openssl-3-debugsource
by bugzilla_noreply＠suse.com 12 Jul '24

12 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1223336 Bug ID: 1223336 Summary: openssl-3: variations in openssl-3-debugsource Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: otto.hollmann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: pmonrealgonzalez(a)suse.com Blocks: 1062303 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our openssl-3 package debugsource varies in /usr/src/debug/openssl-3.1.4/crypto/modes/aes-gcm-avx512.s --- old//usr/src/debug/openssl-3.1.4/crypto/modes/aes-gcm-avx512.s +++ new//usr/src/debug/openssl-3.1.4/crypto/modes/aes-gcm-avx512.s @@ -24,14 +24,14 @@ movl 240(%rdi),%eax cmpl $9,%eax - je .Laes_128_rujxAgiqdxpwrqy + je .Laes_128_ovGcEknxlsxtefb cmpl $11,%eax - je .Laes_192_rujxAgiqdxpwrqy + je .Laes_192_ovGcEknxlsxtefb cmpl $13,%eax ... This file is created by ["/usr/bin/perl", "crypto/modes/asm/../../perlasm/x86_64-xlate.pl", "elf", "crypto/modes/aes-gcm-avx512.s"] called by ["/usr/bin/perl", "crypto/modes/asm/aes-gcm-avx512.pl", "elf", "-I.", "-Iinclude", "-Iproviders/common/include", "-Iproviders/implementations/include", "-fPIC", "-pthread", "-m64", "-Wa,--noexecstack", "-Wall", "-O3", "-march=x86-64-v3", "-O2", "-Wall", "-U_FORTIFY_SOURCE", "-fstack-protector-strong", "-funwind-tables", "-fasynchronous-unwind-tables", "-fstack-clash-protection", "-Werror=return-type", "-flto=auto", "-Wa,--noexecstack", "-fno-common", "-Wall", "-DOPENSSL_USE_NODELETE", "-DL_ENDIAN", "-DOPENSSL_PIC", "-DOPENSSLDIR=\"/etc/ssl\"", "-DENGINESDIR=\"/usr/lib64/engines-3\"", "-DMODULESDIR=\"/usr/lib64/ossl-modules\"", "-DOPENSSL_BUILDING_OPENSSL", "-DZLIB", "-DNDEBUG", "-D_FORTIFY_SOURCE=3", "-DTERMIO", "-DPURIFY", "-D_GNU_SOURCE", "-DOPENSSL_NO_BUF_FREELISTS", "-DSYSTEM_CIPHERS_FILE=\"/etc/crypto-policies/back-ends/openssl.config\"", "-DAES_ASM", "-DBSAES_ASM", "-DCMLL_ASM", "-DECP_NISTZ256_ASM", "-DGHASH_ASM", "-DKECCAK1600_ASM", "-DMD5_ASM", "-DOPENSSL_BN_ASM_GF2m", "-DOPENSSL_BN_ASM_MONT", "-DOPENSSL_BN_ASM_MONT5", "-DOPENSSL_CPUID_OBJ", "-DOPENSSL_IA32_SSE2", "-DPOLY1305_ASM", "-DRC4_ASM", "-DSHA1_ASM", "-DSHA256_ASM", "-DSHA512_ASM", "-DVPAES_ASM", "-DWHIRLPOOL_ASM", "-DX25519_ASM", "crypto/modes/aes-gcm-avx512.s"] and another such call without -march=x86-64-v3 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1221986] New: VUL-0: : python-Scrapy: decompression bomb vulnerability
by bugzilla_noreply＠suse.com 11 Jul '24

11 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221986 Bug ID: 1221986 Summary: VUL-0: : python-Scrapy: decompression bomb vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Scrapy limits allowed response sizes by default through the DOWNLOAD_MAXSIZE and DOWNLOAD_WARNSIZE settings. However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to decompression bombs. A malicious website being scraped could send a small response that, on decompression, could exhaust the memory available to the Scrapy process, potentially affecting any other process sharing that memory, and affecting disk usage in case of uncompressed response caching. References: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1220514] New: VUL-0: CVE-2024-1892: python-Scrapy: parts of API are vulnerable to a ReDoS attack
by bugzilla_noreply＠suse.com 11 Jul '24

11 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220514 Bug ID: 1220514 Summary: VUL-0: CVE-2024-1892: python-Scrapy: parts of API are vulnerable to a ReDoS attack Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/395399/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1892 https://www.cve.org/CVERecord?id=CVE-2024-1892 https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b https://docs.scrapy.org/en/latest/news.html#scrapy-2-11-0-2023-09-18 Patch: https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb875… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1220882] New: qemu/kvm install in distrobox / Tumbleweed x86_64 fails in posttrans
by bugzilla_noreply＠suse.com 10 Jul '24

10 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220882 Bug ID: 1220882 Summary: qemu/kvm install in distrobox / Tumbleweed x86_64 fails in posttrans Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello seems like qemu/kvm install inside container (distrobox) is not working as expected. https://en.opensuse.org/Distrobox It seems to detect container as Legacy system, perhaps that's fine, but perhaps it would be fair to treat containers differently. I'm personally not interested in running virt stack inside container, however, they're dependencies pulled as part of sudo zypper in openSUSE-release-tools osc-plugins-staging The host OS is Leap 15.6, however what matters is the containers OS and that's freshly deployed openSUSE Tumbleweed, where the installation raises errors. (292/307) Installing: librbd1-16.2.14.66+g7aa6ce9419f-3.2.x86_64 .........[done] (293/307) Installing: qemu-block-rbd-8.2.1-3.1.x86_64 ....................[done] (294/307) Installing: qemu-tools-8.2.1-3.1.x86_64 ........................[done] (295/307) Installing: qemu-x86-8.2.1-3.1.x86_64 ..........................[done] stat: cannot statx '/proc/1/root/': Permission denied /var/tmp/rpm-tmp.koFhq8: line 2: [: =: unary operator expected (296/307) Installing: qemu-8.2.1-3.1.x86_64 ..............................[done] (297/307) Installing: qemu-ovmf-x86_64-202308-3.5.noarch .................[done] (298/307) Installing: build-20240221-1.1.noarch ..........................[done] (299/307) Installing: build-mkdrpms-20240221-1.1.noarch ..................[done] (300/307) Installing: obs-service-source_validator-0.34-2.1.noarch .......[done] (301/307) Installing: obs-service-download_files-0.9.2-1.3.noarch ........[done] (302/307) Installing: obs-service-format_spec_file-20240121-1.2.noarch ...[done] (303/307) Installing: obs-service-tar_scm-0.10.43-1.1.noarch .............[done] (304/307) Installing: obs-service-obs_scm-0.10.43-1.1.noarch .............[done] (305/307) Installing: osc-1.6.1-1.1.noarch ...............................[done] (306/307) Installing: openSUSE-release-tools-20240223.f941f9d-1.1.noarch .[done] (307/307) Installing: osclib-20240223.f941f9d-1.1.noarch .................[done] %posttrans(kvm_stat-6.7.7-23.3.noarch) script output: Failed to send reload request: Permission denied error: lua script failed: [string "%transfiletriggerin(udev-254.9-2.1.x86_64)"]:4: exit code %transfiletriggerin(sdbootutil-1+git20240215.cb7e392-1.1.x86_64) script output: Error: No ESP detected. Legacy system? warning: %transfiletriggerin(sdbootutil-1+git20240215.cb7e392-1.1.x86_64) scriptlet failed, exit status 1 Running post-transaction scripts .........................................[done] Installation has completed with error. lkocman@tw:~> -- You are receiving this mail because: You are on the CC list for the bug.

1 5