April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1198683] VUL-1: CVE-2022-1245: keycloak: Privilege escalation vulnerability on Token Exchange
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1198683 https://bugzilla.suse.com/show_bug.cgi?id=1198683#c2 Fridrich Strba <fstrba(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|fstrba(a)suse.com |security-team(a)suse.de --- Comment #2 from Fridrich Strba <fstrba(a)suse.com> --- The package lives here https://build.opensuse.org/package/show/Java:binaries/keycloak and the version there is the repackaged 24.0.2 which is having this one fixed. I don't see it anywhere in backports, so most likely it is not there. Reassigning to security to know what to do: close or not to close. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1211784] VUL-0: CVE-2023-1664: keycloak: Untrusted Certificate Validation
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1211784 https://bugzilla.suse.com/show_bug.cgi?id=1211784#c1 Fridrich Strba <fstrba(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|fstrba(a)suse.com |security-team(a)suse.de --- Comment #1 from Fridrich Strba <fstrba(a)suse.com> --- The package lives here https://build.opensuse.org/package/show/Java:binaries/keycloak and the version there is the repackaged 24.0.2 which is having this one fixed. I don't see it anywhere in backports, so most likely it is not there. Reassigning to security to know what to do: close or not to close. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1198920] VUL-0: CVE-2022-1466: keycloak: Improper authorization for master realm
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1198920 https://bugzilla.suse.com/show_bug.cgi?id=1198920#c6 Fridrich Strba <fstrba(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|fstrba(a)suse.com |security-team(a)suse.de --- Comment #6 from Fridrich Strba <fstrba(a)suse.com> --- The package lives here https://build.opensuse.org/package/show/Java:binaries/keycloak and the version there is the repackaged 24.0.2 which is having this one fixed. I don't see it anywhere in backports, so most likely it is not there. Reassigning to security to know what to do: close or not to close. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221356] UEFI Installation Parameter ifcfg/netsetup with static ip ignored for network interface
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1221356 https://bugzilla.suse.com/show_bug.cgi?id=1221356#c6 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #6 from Stefan Hundhammer <shundhammer(a)suse.com> --- Duh; I overlooked the part that they were not added to the kernel parameters. Please try that; I am sure then it will be successful. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221361] /etc/profile.d/alljava.csh sets JAVA_HOME incorrectly
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1221361 https://bugzilla.suse.com/show_bug.cgi?id=1221361#c7 --- Comment #7 from Ruediger Oertel <ro(a)suse.com> --- https://github.com/openSUSE/aaa_base/pull/147 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221361] /etc/profile.d/alljava.csh sets JAVA_HOME incorrectly
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1221361 https://bugzilla.suse.com/show_bug.cgi?id=1221361#c6 --- Comment #6 from Ruediger Oertel <ro(a)suse.com> --- well, since I added the "-e ..." at the same time I'm currently thinking about dropping that stderr redir completely. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221356] UEFI Installation Parameter ifcfg/netsetup with static ip ignored for network interface
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1221356 https://bugzilla.suse.com/show_bug.cgi?id=1221356#c5 Steffen Winterfeldt <snwint(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(snwint(a)suse.com) | --- Comment #5 from Steffen Winterfeldt <snwint(a)suse.com> --- These are boot options. If you edit grub.cfg, you have to append them to the 'linux' line: linux /boot/x86_64/loader/linux splash=silent ifcfg=eth0=... autoyast=http... Your variant 1 is ok. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221840] podman with pasta (passt) fails with apparmor
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1221840 https://bugzilla.suse.com/show_bug.cgi?id=1221840#c21 --- Comment #21 from Danish Prakash <danish.prakash(a)suse.com> --- Created attachment 874006 --> https://bugzilla.suse.com/attachment.cgi?id=874006&action=edit audit log passt ptrace (In reply to Christian Boltz from comment #18) > From the patch: > > +++ b/contrib/apparmor/usr.bin.pasta > > + ptrace, > > Just wondering - does pasta really need to trace everything, and be traced > by everything - or could you make the rule more specific? > > If you are unsure, please show the audit.log events for ptrace. I've attached a snippet from `ausearch` which led me to add ptrace to the profile, I haven't explored this further I must admit. (In reply to Stefano Brivio from comment #20) > Thanks, it looks good to me, but I haven't looked yet into how to possibly > restricting the 'ptrace' rule as suggested by Christian in comment #18. > > I can probably manage to look into it later today if you don't. Once that's > solved, yes, I would apply this upstream. Just to confirm: you're testing > with this patch on top of mine from comment #12, correct? Yes, it's on top of your patch from comment #13 and the changes I made to the package i.e. overriding symlinks with hardlinks. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221356] UEFI Installation Parameter ifcfg/netsetup with static ip ignored for network interface
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1221356 https://bugzilla.suse.com/show_bug.cgi?id=1221356#c4 --- Comment #4 from Stefan Hundhammer <shundhammer(a)suse.com> --- See also https://doc.opensuse.org/projects/autoyast/#ay-adv-network -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222235] installation-images: update for crypto-policies/krb5
by bugzilla_noreply＠suse.com 02 Apr '24

02 Apr '24

https://bugzilla.suse.com/show_bug.cgi?id=1222235 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0