April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1222314] New: YaST doesn't set zypper locales during installation
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1222314 Bug ID: 1222314 Summary: YaST doesn't set zypper locales during installation Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: fvogt(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 874066 --> https://bugzilla.suse.com/attachment.cgi?id=874066&action=edit YaST installation logs I installed YaST with German locale. While the system has the locale configured as expected (e.g. /etc/locale.conf), zypper does not: ~> sudo zypper locales Code | Language | Requested -----+----------+---------- As a result, language specific packages are missing. -- You are receiving this mail because: You are on the CC list for the bug.

1 51

[Bug 1212877] New: [RPi4] cannot wake up after suspend triggered
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1212877 Bug ID: 1212877 Summary: [RPi4] cannot wake up after suspend triggered Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 867900 --> https://bugzilla.suse.com/attachment.cgi?id=867900&action=edit yast2 logs ssh to my RPi 4 Model B, later I see following -- p200300ea3707b36b055205817bcf9853:~ # Broadcast message from root@localhost (Fri 2023-06-30 06:03:37 UTC): The system will suspend now! -- then I try to wake it up by hitting keyboard and click on mouse, nothing happened on screen. attache yast2logs. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1212947] New: Disable fbdev userspace interfaces and programs
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1212947 Bug ID: 1212947 Summary: Disable fbdev userspace interfaces and programs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: tzimmermann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- We want to remove fbdev from kernel and userspace as far as possible. Linux 6.6 will allow us to disable fbdev's userspace interfaces, most noteably /dev/fb*. Enable this feature in the TW kernel. Framebuffer support has been an endless source of bugs. Not giving userspace access to it's internals and framebuffer memory will close a possible entry point for all sorts of malware. Please note that the framebuffer console is implemented entirely within the kernel and will not be affected by this change. -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1220088] New: Hibernate completes shuts machine off *then* machine automatically turns back on.
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1220088 Bug ID: 1220088 Summary: Hibernate completes shuts machine off *then* machine automatically turns back on. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: pj.opensuse(a)gmx.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi, when hibernate is envoked from the Tumbleweed menu the hibernate feature seems to complete and shutoff the machine for 2 seconds...... Then the machine automatically powers back on. I enter the LUKS password and the machine continues to boot. I enter the user password at SDDM screen. After loading KDE I can then see that Hibernate has indeed worked. Largest issue is machine is cycling, (powering back on) after hibernation has been envoked. I have shut off all wake-on power options in the bios settings. The machine is kept very current with the latest updates. What are your thoughts on this? -Best Regards -- You are receiving this mail because: You are on the CC list for the bug.

1 25

[Bug 1216919] New: dkimproxy broken after upgrade to Leap 15.4/conversion to systemd services
by bugzilla_noreply＠suse.com 09 Dec '24

09 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1216919 Bug ID: 1216919 Summary: dkimproxy broken after upgrade to Leap 15.4/conversion to systemd services Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: All OS: openSUSE Leap 15.4 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: rombert(a)apache.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I have upgrade to Leap 15.4 to find my dkimproxy setup broken. I noticed the following things: 1. there was one dkimproxy service, now there are two dkimproxy-in and dkimproxy-out. The new services are disabled even though the old one was enabled 2. The dkimproxy_in.service file references the /run/sysconfig/dkimproxy environment file 2a. The dkimproxy_env.sh script is supposed to create that file, but /run/sysconfig is not created at all to that script fails 2b. The dkimproxy_env.sh sets "HFQHN=$( hostname -f )" dkimproxy-in.service uses --hostname=${FQHN} While problem 1 is a one-time fix, the problems from 2 are more persistent and are ideally solved in the package. Note: systemd integration was contributed in bug #1116007 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1213380] New: Black Screen Issue on openSUSE Tumbleweed ISO after BIOS with DP-HDMI Video Output
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1213380 Bug ID: 1213380 Summary: Black Screen Issue on openSUSE Tumbleweed ISO after BIOS with DP-HDMI Video Output Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: samcon(a)protonmail.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- I encountered a black screen issue while attempting to boot the openSUSE Tumbleweed ISO after the BIOS on my system. This issue specifically occurs when using a DP-HDMI video output. This problem does not arise when using the same video output with other operating systems like Leap, Fedora, and Ubuntu LTS. In those cases, I am able to get video output without any black screen problems. Steps to Reproduce: 1. Start the computer and access the BIOS. 2. Configure the boot order to prioritize booting from the openSUSE Tumbleweed ISO. 3. Save the changes and exit the BIOS. 4. The system attempts to boot from the ISO. 5. First I see the kernal or bootloader messages, then it jumps to a black screen - with waiting for source message on projector. Expected Behavior: Upon booting from the openSUSE Tumbleweed ISO, the system should display zypper installer instead of a black screen, just like other operating systems do when using the DP-HDMI video output. Additional Information: - Operating System: openSUSE Tumbleweed - Video Output: DP-HDMI - Other operating systems (Leap, Fedora, Ubuntu LTS) do not exhibit the black screen issue with the same video output. - When I connect the same system to the monitor using DP-to-DP instead of DP-to-HDMI, the video output is successfully displayed. - Have used tried with iso from few weeks back and latest Snapshot20230714-Media.iso Kind regards, Sam -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1215927] New: kernel-default-6.5.4 reboots instead of resuming from suspend
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1215927 Bug ID: 1215927 Summary: kernel-default-6.5.4 reboots instead of resuming from suspend Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: psychonaut(a)nothingisreal.com QA Contact: qa-bugs(a)suse.de CC: mrmazda(a)earthlink.net Target Milestone: --- Found By: --- Blocker: --- I upgraded from Tumbleweed 20230908 to 20230921, which included an upgrade from kernel-default-6.4.12 to kernel-default-6.5.4. I always suspend my computer at night (with systemctl suspend) and wake it the next morning. With the new kernel, the computer always restarts instead of resuming from suspend. The problem does not occur with the old kernel. Interestingly, the problem is reproducible only when I leave the computer suspended overnight. Simply suspending the computer and then waking it a few seconds later does not trigger the bug. hwinfo output (with the old kernel) is available in Attachment 869836 of Bug 1215826. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1219444] New: amdgpu critical error
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219444 Bug ID: 1219444 Summary: amdgpu critical error Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: teuniz(a)protonmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 872372 --> https://bugzilla.suse.com/attachment.cgi?id=872372&action=edit Output of dmesg The kernel crashes approx every 5 minutes. I reverted back to kernel 5.14.21-150500.55.19-default because with that one it crashes approx once a day. Operating System: openSUSE Leap 15.5 KDE Plasma Version: 5.27.9 KDE Frameworks Version: 5.103.0 Qt Version: 5.15.8 Kernel Version: 5.14.21-150500.55.44-default (64-bit) Graphics Platform: X11 Processors: 32 × 13th Gen Intel Core i9-13900K Memory: 31.0 GiB of RAM Graphics Processor: AMD Radeon Pro W6600 Manufacturer: HP Product Name: HP Z2 Tower G9 Workstation Desktop PC dmesg | grep amdgpu [ 1.540640] [drm] amdgpu kernel modesetting enabled. [ 1.540703] amdgpu: CRAT table not found [ 1.540705] amdgpu: Virtual CRAT table created for CPU [ 1.540712] amdgpu: Topology: Add CPU node [ 1.542670] amdgpu 0000:03:00.0: amdgpu: Fetched VBIOS from VFCT [ 1.542671] amdgpu: ATOM BIOS: 113-D5330400-100 [ 1.542770] amdgpu 0000:03:00.0: vgaarb: deactivate vga console [ 1.542771] amdgpu 0000:03:00.0: amdgpu: Trusted Memory Zone (TMZ) feature disabled as experimental (default) [ 1.542799] amdgpu 0000:03:00.0: amdgpu: VRAM: 8176M 0x0000008000000000 - 0x00000081FEFFFFFF (8176M used) [ 1.542800] amdgpu 0000:03:00.0: amdgpu: GART: 512M 0x0000000000000000 - 0x000000001FFFFFFF [ 1.542801] amdgpu 0000:03:00.0: amdgpu: AGP: 267894784M 0x0000008400000000 - 0x0000FFFFFFFFFFFF [ 1.542845] [drm] amdgpu: 8176M of VRAM memory ready [ 1.542845] [drm] amdgpu: 15892M of GTT memory ready. [ 1.548699] amdgpu 0000:03:00.0: amdgpu: PSP runtime database doesn't exist [ 1.548704] amdgpu 0000:03:00.0: amdgpu: PSP runtime database doesn't exist [ 2.854516] amdgpu 0000:03:00.0: amdgpu: STB initialized to 2048 entries [ 2.895100] amdgpu 0000:03:00.0: amdgpu: Will use PSP to load VCN firmware [ 3.094413] amdgpu 0000:03:00.0: amdgpu: RAS: optional ras ta ucode is not available [ 3.115717] amdgpu 0000:03:00.0: amdgpu: SECUREDISPLAY: securedisplay ta ucode is not available [ 3.115740] amdgpu 0000:03:00.0: amdgpu: smu driver if version = 0x0000000f, smu fw if version = 0x00000013, smu fw program = 0, version = 0x003b2b00 (59.43.0) [ 3.115745] amdgpu 0000:03:00.0: amdgpu: SMU driver if version not matched [ 3.115777] amdgpu 0000:03:00.0: amdgpu: use vbios provided pptable [ 3.165133] amdgpu 0000:03:00.0: amdgpu: SMU is initialized successfully! [ 3.268063] kfd kfd: amdgpu: Allocated 3969056 bytes on gart [ 3.268478] amdgpu: sdma_bitmap: ffff [ 3.302091] amdgpu: HMM registered 8176MB device memory [ 3.302135] amdgpu: SRAT table not found [ 3.302136] amdgpu: Virtual CRAT table created for GPU [ 3.302599] amdgpu: Topology: Add dGPU node [0x73e3:0x1002] [ 3.302601] kfd kfd: amdgpu: added device 1002:73e3 [ 3.302617] amdgpu 0000:03:00.0: amdgpu: SE 2, SH per SE 2, CU per SH 8, active_cu_number 28 [ 3.302658] amdgpu 0000:03:00.0: amdgpu: ring gfx_0.0.0 uses VM inv eng 0 on hub 0 [ 3.302659] amdgpu 0000:03:00.0: amdgpu: ring comp_1.0.0 uses VM inv eng 1 on hub 0 [ 3.302659] amdgpu 0000:03:00.0: amdgpu: ring comp_1.1.0 uses VM inv eng 4 on hub 0 [ 3.302660] amdgpu 0000:03:00.0: amdgpu: ring comp_1.2.0 uses VM inv eng 5 on hub 0 [ 3.302660] amdgpu 0000:03:00.0: amdgpu: ring comp_1.3.0 uses VM inv eng 6 on hub 0 [ 3.302661] amdgpu 0000:03:00.0: amdgpu: ring comp_1.0.1 uses VM inv eng 7 on hub 0 [ 3.302661] amdgpu 0000:03:00.0: amdgpu: ring comp_1.1.1 uses VM inv eng 8 on hub 0 [ 3.302662] amdgpu 0000:03:00.0: amdgpu: ring comp_1.2.1 uses VM inv eng 9 on hub 0 [ 3.302662] amdgpu 0000:03:00.0: amdgpu: ring comp_1.3.1 uses VM inv eng 10 on hub 0 [ 3.302663] amdgpu 0000:03:00.0: amdgpu: ring kiq_2.1.0 uses VM inv eng 11 on hub 0 [ 3.302663] amdgpu 0000:03:00.0: amdgpu: ring sdma0 uses VM inv eng 12 on hub 0 [ 3.302664] amdgpu 0000:03:00.0: amdgpu: ring sdma1 uses VM inv eng 13 on hub 0 [ 3.302665] amdgpu 0000:03:00.0: amdgpu: ring vcn_dec_0 uses VM inv eng 0 on hub 1 [ 3.302665] amdgpu 0000:03:00.0: amdgpu: ring vcn_enc_0.0 uses VM inv eng 1 on hub 1 [ 3.302666] amdgpu 0000:03:00.0: amdgpu: ring vcn_enc_0.1 uses VM inv eng 4 on hub 1 [ 3.302666] amdgpu 0000:03:00.0: amdgpu: ring jpeg_dec uses VM inv eng 5 on hub 1 [ 3.303573] [drm] Initialized amdgpu 3.49.0 20150101 for 0000:03:00.0 on minor 0 [ 3.308709] fbcon: amdgpudrmfb (fb0) is primary device [ 3.505728] amdgpu 0000:03:00.0: amdgpu: [mmhub] page fault (src_id:0 ring:157 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 3.505731] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000006004000 from client 0x12 (VMC) [ 3.505733] amdgpu 0000:03:00.0: amdgpu: MMVM_L2_PROTECTION_FAULT_STATUS:0x0000073A [ 3.505733] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: DCEDMC (0x3) [ 3.505734] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 3.505735] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x5 [ 3.505735] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x3 [ 3.505735] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x1 [ 3.505736] amdgpu 0000:03:00.0: amdgpu: RW: 0x0 [ 3.524299] amdgpu 0000:03:00.0: [drm] fb0: amdgpudrmfb frame buffer device [ 4.537456] snd_hda_intel 0000:03:00.1: bound 0000:03:00.0 (ops amdgpu_dm_audio_component_bind_ops [amdgpu]) [ 5.416287] amdgpu 0000:03:00.0: amdgpu: [mmhub] page fault (src_id:0 ring:157 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 5.416312] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000006004000 from client 0x12 (VMC) [ 5.416319] amdgpu 0000:03:00.0: amdgpu: MMVM_L2_PROTECTION_FAULT_STATUS:0x00000000 [ 5.416324] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: unknown (0x0) [ 5.416329] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 5.416333] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x0 [ 5.416336] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x0 [ 5.416340] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x0 [ 5.416343] amdgpu 0000:03:00.0: amdgpu: RW: 0x0 [ 73.156519] amdgpu 0000:03:00.0: amdgpu: [mmhub] page fault (src_id:0 ring:157 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 73.156538] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000006004000 from client 0x12 (VMC) [ 73.156546] amdgpu 0000:03:00.0: amdgpu: MMVM_L2_PROTECTION_FAULT_STATUS:0x0000073A [ 73.156551] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: DCEDMC (0x3) [ 73.156562] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 73.156566] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x5 [ 73.156570] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x3 [ 73.156578] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x1 [ 73.156582] amdgpu 0000:03:00.0: amdgpu: RW: 0x0 uname -a 5.14.21-150500.55.44-default #1 SMP PREEMPT_DYNAMIC Mon Jan 15 10:03:40 UTC 2024 (cc7d8b6) x86_64 x86_64 x86_64 GNU/Linux lspci VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Navi 23 WKS-XL [Radeon PRO W6600] -- You are receiving this mail because: You are on the CC list for the bug.

1 16