April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1221085] New: encfs segfaults
by bugzilla_noreply＠suse.com 12 Jul '24

12 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221085 Bug ID: 1221085 Summary: encfs segfaults Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: tiwai(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After upgrading from leap 15.5 to 15.6, mounting via encfs causes a segfault. Reverting back to leap 15.5 package fixed. My understanding is that this happens because we now build with openssl3 while it was openssl1 in leap 15.5. When I rebuild the package with libopenssl-1_1-devel instead of openssl-devel, it starts working. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223336] New: openssl-3: variations in openssl-3-debugsource
by bugzilla_noreply＠suse.com 12 Jul '24

12 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1223336 Bug ID: 1223336 Summary: openssl-3: variations in openssl-3-debugsource Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: otto.hollmann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: pmonrealgonzalez(a)suse.com Blocks: 1062303 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our openssl-3 package debugsource varies in /usr/src/debug/openssl-3.1.4/crypto/modes/aes-gcm-avx512.s --- old//usr/src/debug/openssl-3.1.4/crypto/modes/aes-gcm-avx512.s +++ new//usr/src/debug/openssl-3.1.4/crypto/modes/aes-gcm-avx512.s @@ -24,14 +24,14 @@ movl 240(%rdi),%eax cmpl $9,%eax - je .Laes_128_rujxAgiqdxpwrqy + je .Laes_128_ovGcEknxlsxtefb cmpl $11,%eax - je .Laes_192_rujxAgiqdxpwrqy + je .Laes_192_ovGcEknxlsxtefb cmpl $13,%eax ... This file is created by ["/usr/bin/perl", "crypto/modes/asm/../../perlasm/x86_64-xlate.pl", "elf", "crypto/modes/aes-gcm-avx512.s"] called by ["/usr/bin/perl", "crypto/modes/asm/aes-gcm-avx512.pl", "elf", "-I.", "-Iinclude", "-Iproviders/common/include", "-Iproviders/implementations/include", "-fPIC", "-pthread", "-m64", "-Wa,--noexecstack", "-Wall", "-O3", "-march=x86-64-v3", "-O2", "-Wall", "-U_FORTIFY_SOURCE", "-fstack-protector-strong", "-funwind-tables", "-fasynchronous-unwind-tables", "-fstack-clash-protection", "-Werror=return-type", "-flto=auto", "-Wa,--noexecstack", "-fno-common", "-Wall", "-DOPENSSL_USE_NODELETE", "-DL_ENDIAN", "-DOPENSSL_PIC", "-DOPENSSLDIR=\"/etc/ssl\"", "-DENGINESDIR=\"/usr/lib64/engines-3\"", "-DMODULESDIR=\"/usr/lib64/ossl-modules\"", "-DOPENSSL_BUILDING_OPENSSL", "-DZLIB", "-DNDEBUG", "-D_FORTIFY_SOURCE=3", "-DTERMIO", "-DPURIFY", "-D_GNU_SOURCE", "-DOPENSSL_NO_BUF_FREELISTS", "-DSYSTEM_CIPHERS_FILE=\"/etc/crypto-policies/back-ends/openssl.config\"", "-DAES_ASM", "-DBSAES_ASM", "-DCMLL_ASM", "-DECP_NISTZ256_ASM", "-DGHASH_ASM", "-DKECCAK1600_ASM", "-DMD5_ASM", "-DOPENSSL_BN_ASM_GF2m", "-DOPENSSL_BN_ASM_MONT", "-DOPENSSL_BN_ASM_MONT5", "-DOPENSSL_CPUID_OBJ", "-DOPENSSL_IA32_SSE2", "-DPOLY1305_ASM", "-DRC4_ASM", "-DSHA1_ASM", "-DSHA256_ASM", "-DSHA512_ASM", "-DVPAES_ASM", "-DWHIRLPOOL_ASM", "-DX25519_ASM", "crypto/modes/aes-gcm-avx512.s"] and another such call without -march=x86-64-v3 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1221986] New: VUL-0: : python-Scrapy: decompression bomb vulnerability
by bugzilla_noreply＠suse.com 11 Jul '24

11 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221986 Bug ID: 1221986 Summary: VUL-0: : python-Scrapy: decompression bomb vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Scrapy limits allowed response sizes by default through the DOWNLOAD_MAXSIZE and DOWNLOAD_WARNSIZE settings. However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to decompression bombs. A malicious website being scraped could send a small response that, on decompression, could exhaust the memory available to the Scrapy process, potentially affecting any other process sharing that memory, and affecting disk usage in case of uncompressed response caching. References: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1220514] New: VUL-0: CVE-2024-1892: python-Scrapy: parts of API are vulnerable to a ReDoS attack
by bugzilla_noreply＠suse.com 11 Jul '24

11 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220514 Bug ID: 1220514 Summary: VUL-0: CVE-2024-1892: python-Scrapy: parts of API are vulnerable to a ReDoS attack Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/395399/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1892 https://www.cve.org/CVERecord?id=CVE-2024-1892 https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b https://docs.scrapy.org/en/latest/news.html#scrapy-2-11-0-2023-09-18 Patch: https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb875… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1220882] New: qemu/kvm install in distrobox / Tumbleweed x86_64 fails in posttrans
by bugzilla_noreply＠suse.com 10 Jul '24

10 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220882 Bug ID: 1220882 Summary: qemu/kvm install in distrobox / Tumbleweed x86_64 fails in posttrans Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello seems like qemu/kvm install inside container (distrobox) is not working as expected. https://en.opensuse.org/Distrobox It seems to detect container as Legacy system, perhaps that's fine, but perhaps it would be fair to treat containers differently. I'm personally not interested in running virt stack inside container, however, they're dependencies pulled as part of sudo zypper in openSUSE-release-tools osc-plugins-staging The host OS is Leap 15.6, however what matters is the containers OS and that's freshly deployed openSUSE Tumbleweed, where the installation raises errors. (292/307) Installing: librbd1-16.2.14.66+g7aa6ce9419f-3.2.x86_64 .........[done] (293/307) Installing: qemu-block-rbd-8.2.1-3.1.x86_64 ....................[done] (294/307) Installing: qemu-tools-8.2.1-3.1.x86_64 ........................[done] (295/307) Installing: qemu-x86-8.2.1-3.1.x86_64 ..........................[done] stat: cannot statx '/proc/1/root/': Permission denied /var/tmp/rpm-tmp.koFhq8: line 2: [: =: unary operator expected (296/307) Installing: qemu-8.2.1-3.1.x86_64 ..............................[done] (297/307) Installing: qemu-ovmf-x86_64-202308-3.5.noarch .................[done] (298/307) Installing: build-20240221-1.1.noarch ..........................[done] (299/307) Installing: build-mkdrpms-20240221-1.1.noarch ..................[done] (300/307) Installing: obs-service-source_validator-0.34-2.1.noarch .......[done] (301/307) Installing: obs-service-download_files-0.9.2-1.3.noarch ........[done] (302/307) Installing: obs-service-format_spec_file-20240121-1.2.noarch ...[done] (303/307) Installing: obs-service-tar_scm-0.10.43-1.1.noarch .............[done] (304/307) Installing: obs-service-obs_scm-0.10.43-1.1.noarch .............[done] (305/307) Installing: osc-1.6.1-1.1.noarch ...............................[done] (306/307) Installing: openSUSE-release-tools-20240223.f941f9d-1.1.noarch .[done] (307/307) Installing: osclib-20240223.f941f9d-1.1.noarch .................[done] %posttrans(kvm_stat-6.7.7-23.3.noarch) script output: Failed to send reload request: Permission denied error: lua script failed: [string "%transfiletriggerin(udev-254.9-2.1.x86_64)"]:4: exit code %transfiletriggerin(sdbootutil-1+git20240215.cb7e392-1.1.x86_64) script output: Error: No ESP detected. Legacy system? warning: %transfiletriggerin(sdbootutil-1+git20240215.cb7e392-1.1.x86_64) scriptlet failed, exit status 1 Running post-transaction scripts .........................................[done] Installation has completed with error. lkocman@tw:~> -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1214364] New: net-snmp: new release 5.9.4
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1214364 Bug ID: 1214364 Summary: net-snmp: new release 5.9.4 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: abergmann(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- https://github.com/net-snmp/net-snmp/blob/v5.9.4/CHANGES *5.9.4*: IMPORTANT: SNMP over TLS and/or DTLS are not functioning properly in this release with various versions of OpenSSL and will be fixed in a future release. libsnmp: - Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not used in the Net-SNMP code base. - DISPLAY-HINT fixes - Miscellanious improvements to the transports - Handle multiple oldEngineID configuration lines - fixes for DNS names longer than 63 characters agent: - Added a ignoremount configuration option for the HOST-MIB - disallow SETs with a NULL varbind - fix the --enable-minimalist build apps: - snmpset: allow SET with NULL varbind for testing - snmptrapd: improved MySQL logging code general: - configure: Remove -Wno-deprecated as it is no longer needed - miscellanious ther bug fixes, build fixes and cleanups -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1220520] New: Configure remote printer: does not disable local cups entirely
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220520 Bug ID: 1220520 Summary: Configure remote printer: does not disable local cups entirely Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: All Status: NEW Severity: Minor Priority: P5 - None Component: Printing Assignee: jsmeix(a)suse.com Reporter: bnacht(a)web.de QA Contact: jsmeix(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Fresh installed Leap; Configure a remote printer; Get the message that the local cups will be disabled -> OK; But after that I get the message that the local cups is running again. It looks like YaST does only disable cups.service; cups.socket and cups.path, but not stop them (missing --now ?) After I stop the three units the config was successful. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1223413] New: [TRACKER] FTBFS due to boost 1.85
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1223413 Bug ID: 1223413 Summary: [TRACKER] FTBFS due to boost 1.85 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- A non exhaustive list of packages failing to build directly because boost 1.85: * hugin https://bugzilla.opensuse.org/show_bug.cgi?id=1223377 (FIXED) * rstudio https://bugzilla.opensuse.org/show_bug.cgi?id=1223378 * znc https://bugzilla.opensuse.org/show_bug.cgi?id=1223381 * lucene++ SR https://build.opensuse.org/request/show/1170262 * uhd * FreeCAD * wt * sfcgal -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1222156] New: After an upgrade the graphical interface no longer works
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222156 Bug ID: 1222156 Summary: After an upgrade the graphical interface no longer works Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: rm.canella(a)gmail.com QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On my HP 255 G5 Notebook PC, following "zypper dup --no-allow-vendor-change" (openSUSE-20231218-0) the system no longer starts in graphics mode. - I did some checks and the problem seems to be on the "radeonsi_dri" driver; The following error message appears in the dmesg: [ 84.119680] gnome-shell[1557]: segfault at 40 ip 00007ff2ca32b98d sp 00007ffe59c27170 error 4 in radeonsi_dri.so[7ff2c9c91000+1476000] likely on CPU 1 (core 1, socket 0) - Doing an lspci the video card is: 00:01.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Mullins [Radeon R3 Graphics] (rev 40) - And the following is the output of the zypper info kernel-firmware-radeon command: Information for package kernel-firmware-radeon: ------------------------------------------------- Repository : Main Repository (OSS) Name : kernel-firmware-radeon Version: 20240322-1.1 Arch : noarch Vendor: openSUSE Installed Size: 3.3 MiB Installed : Yes (automatically) Status: up-to-date Source package : kernel-firmware-20240322-1.1.src Upstream URL: https://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/ Summary : Kernel firmware files for Radeon graphics driver Description: This package contains compressed kernel firmware files for Radeon graphics driver. -- You are receiving this mail because: You are on the CC list for the bug.

1 40

[Bug 1217688] New: mariadb: a table is missing inserted entries from concurrent processes
by bugzilla_noreply＠suse.com 08 Jul '24

08 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1217688 Bug ID: 1217688 Summary: mariadb: a table is missing inserted entries from concurrent processes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://jira.mariadb.org/browse/MDEV-32871 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: danilo.spinella(a)suse.com Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 871082 --> https://bugzilla.suse.com/attachment.cgi?id=871082&action=edit db inserter With mariadb: 11.0.2, 11.1.2 and 11.1.3 (from server:database): From my c++ code, using connector-c, I do: SET autocommit=0 CREATE TABLE IF NOT EXISTS sources(id INTEGER AUTO_INCREMENT PRIMARY KEY, src VARCHAR(1024) NOT NULL UNIQUE) INSERT IGNORE INTO sources(src) VALUES (?) START TRANSACTION And then a lot of: INSERT IGNORE INTO sources(src) VALUES ('src-003431-00001') src is composed of pid and values from 0 to 49. So they are all unique. Finally, I do: COMMIT If I run 10 instances in parallel like: for aa in {1..10} ; do ./db & done ; wait I see: select count(id), substr(src,5,6) as sss from sources group by sss; +-----------+--------+ | count(id) | sss | +-----------+--------+ | 50 | 003430 | | 50 | 003431 | | 50 | 003432 | | 40 | 003433 | | 50 | 003434 | | 50 | 003435 | | 50 | 003436 | | 50 | 003437 | | 50 | 003438 | | 50 | 003439 | +-----------+--------+ I.e. Some of pids stored only last 40 values, numbers 0..9 are missing in the table: select src from sources where src like '%003433%' order by src ; +------------------+ | src | +------------------+ | src-003433-00010 | | src-003433-00011 | | src-003433-00012 | | src-003433-00013 | | src-003433-00014 | | src-003433-00015 | | src-003433-00016 | | src-003433-00017 | | src-003433-00018 | | src-003433-00019 | | src-003433-00020 | | src-003433-00021 | | src-003433-00022 | | src-003433-00023 | | src-003433-00024 | | src-003433-00025 | | src-003433-00026 | | src-003433-00027 | | src-003433-00028 | | src-003433-00029 | | src-003433-00030 | | src-003433-00031 | | src-003433-00032 | | src-003433-00033 | | src-003433-00034 | | src-003433-00035 | | src-003433-00036 | | src-003433-00037 | | src-003433-00038 | | src-003433-00039 | | src-003433-00040 | | src-003433-00041 | | src-003433-00042 | | src-003433-00043 | | src-003433-00044 | | src-003433-00045 | | src-003433-00046 | | src-003433-00047 | | src-003433-00048 | | src-003433-00049 | +------------------+ Is this a bug in my program (attached) or the db? If I look into the general log, I see the inserts which apparently did not get into the table: grep src-003433 /tmp/glog 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00000') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00000') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00000') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00000') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00000') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00001') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00002') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00003') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00004') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00005') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00006') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00007') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00008') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00009') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00010') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00010') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00011') 24 Execute INSERT IGNORE INTO sources(src) VALUES ('src-003433-00012') Note also the repeated inserts. They come from a deadlock, so I repeat the exec in a loop (see the code). Dockers with mariadb:latest (11.2.2) mariadb:11.1.3 mariadb:11.1.2 all run FINE too. -- You are receiving this mail because: You are on the CC list for the bug.

1 14