April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1223544] New: kernel config: enable CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
by bugzilla_noreply＠suse.com 29 May '24

29 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223544 Bug ID: 1223544 Summary: kernel config: enable CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Systemd wants to have CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG to enable signed Verity images: https://github.com/systemd/systemd/blob/main/README#L131 Any chance we can enable that (and potentially other settings we missed) in TW kernels to leverage systemd's full potential? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1223578] New: Ensure that all %ghost entries have %attr() matching the final permissions (e.g. from systemd-tmpfiles)
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223578 Bug ID: 1223578 Summary: Ensure that all %ghost entries have %attr() matching the final permissions (e.g. from systemd-tmpfiles) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- just an example ``` rpm -qlv pipewire | grep /var/lib/pip d--------- 2 root root 0 Apr 17 08:56 /var/lib/pipewire ---------- 1 root root 0 Apr 17 08:56 /var/lib/pipewire/pipewire_post_workaround ``` this then causes unneeded noise e.g. in `rpm -V pipewire` ``` rpm -V pipewire .M....... g /var/lib/pipewire ``` 1. all %ghost entries should come with %attr() ``` %ghost %attr(0644,root,root) %config(noreplace) /etc/apparmor.d/local/%{name} ``` 2. rpmlint check that errors out if the permissions bits for an entry are set to 000 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1217807] New: VUL-0: CVE-2023-47633: traefik: 100% CPU usage when self-serving as backend
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217807 Bug ID: 1217807 Summary: VUL-0: CVE-2023-47633: traefik: 100% CPU usage when self-serving as backend Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386934/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47633 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217804] New: VUL-0: CVE-2023-47106: traefik: incorrect processing of fragment in the URL leads to authorization bypass
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217804 Bug ID: 1217804 Summary: VUL-0: CVE-2023-47106: traefik: incorrect processing of fragment in the URL leads to authorization bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386931/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47106 https://github.com/traefik/traefik/releases/tag/v2.10.6 https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217806] New: VUL-0: CVE-2023-47124: traefik: Potential DDoS whith ACME HTTPChallenge
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217806 Bug ID: 1217806 Summary: VUL-0: CVE-2023-47124: traefik: Potential DDoS whith ACME HTTPChallenge Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386932/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47124 https://doc.traefik.io/traefik/https/acme/#dnschallenge https://github.com/traefik/traefik/releases/tag/v2.10.6 https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1222676] New: EFI Firmware Updates downloaded, but not installed
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222676 Bug ID: 1222676 Summary: EFI Firmware Updates downloaded, but not installed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This has been going on for some months where regardless of whether I use fwupdtool or GNOME Software available firmware updates are shown, downloaded, and a reboot offered, alas when I reboot these updates are not installed. After running whatever update tool, updates are present under /boot/efi/EFI/opensuse/fw. After reboot they are gone - but apparently not installed (and indeed there is nothing unusual during the power on and boot sequence, like I believe I saw in the past when firmware updates were applied): % ls -l /boot/efi/EFI/opensuse/fw -rwxr-xr-x 1 root root 1243680 Apr 1 16:09 fwupd-279599d4-78c7-4c99-84ea-4a7c8d2b10e1.cap -rwxr-xr-x 1 root root 9431077 Apr 1 16:09 fwupd-4e78ce68-5389-4a95-bf10-e3568c30caf8.cap -rwxr-xr-x 1 root root 28843840 Apr 1 16:09 fwupd-a0fd4aef-f691-4c90-a089-7dd4f4481db0.cap % ls -l /boot/efi/EFI/opensuse/ total 4,5M -rwxr-xr-x 1 root root 847k Apr 1 03:39 MokManager.efi -rwxr-xr-x 1 root root 58 Apr 1 03:39 boot.csv drwxr-xr-x 2 root root 4,1k Apr 1 16:09 fw -rwxr-xr-x 1 root root 64k Feb 25 2023 fwupdx64.efi -rwxr-xr-x 1 root root 203 Apr 1 03:39 grub.cfg -rwxr-xr-x 1 root root 2,1M Apr 1 03:39 grub.efi -rwxr-xr-x 1 root root 541k Apr 1 03:39 grubx64.efi -rwxr-xr-x 1 root root 935k Apr 1 03:39 shim.efi Asking naively: is /boot/efi/EFI/opensuse/fw the right directory for these updates to be put in? It looks is if they are not "found", yet "something" removes them upon startup? Hardware is a ThinkPad X1 Yoga Gen 8. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1218393] New: Weird screen blanking (power mgmt?) issue
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218393 Bug ID: 1218393 Summary: Weird screen blanking (power mgmt?) issue Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: rs.opensuse(a)spitzenpfeil.org QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- My screen blanks after screen power mgmt kicks in - as expected. Unfortunately the timer doesn't seem to reset. As long as I move the mouse (even after switching to a console) the screen stays on, once any screen update stops, it goes dark. Currently I to run 'xsnow' !! to keep the screen updating, so it doesn't go dark all the time. This is not fun :-( Where to look? CPU: i7-7700T Graphics: HD 630 P.S.: https://forums.opensuse.org/t/internal-lcd-of-laptop-turning-off-comes-back… -- # VERSION="20231222" ID="opensuse-tumbleweed" -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1222864] New: VUL-0: CVE-2024-31497: putty: NIST P521 private keys are exposed by biased signature generation
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222864 Bug ID: 1222864 Summary: VUL-0: CVE-2024-31497: putty: NIST P521 private keys are exposed by biased signature generation Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick lattice-based attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. One scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victim's private key) can derive the victim's private key, and then use it for unauthorized access to those other services. Because SSH is sometimes used to authenticate to Git services, it is possible that this vulnerability could be leveraged for supply-chain attacks on software maintained in Git. It is also conceivable that signed messages from PuTTY or Pageant are readable by adversaries more easily in other scenarios, but none have yet been disclosed. https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.… https://www.openwall.com/lists/oss-security/2024/04/15/6 https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=c193fe9848f50a88… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1214653] New: yast2 keyboard do not allow to set bépo (french)
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1214653 Bug ID: 1214653 Summary: yast2 keyboard do not allow to set bépo (french) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: jonathan(a)mercier.paris QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Dear, I give a try to OpenSuse Leap 15, but I am unable to go further as they any way to set bépo layout kexyboard. I try from: 1. Leap installer : as bépo was missing I choose the french layout once installation has finished: 2. sudo yast2 keyboard: same layout proposal than given from installer 3. sudo yast2/zypper search : nothing relevant found The point (2) and (3) was done by trying to find each letter as I own only bépo keyboard. This layout is present on RHEL, RockyLinux 7,8,9 and Fedora. It would be much appreciate to add it Thanks best regards -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1221438] New: trash_kcm conflicts kio-core
by bugzilla_noreply＠suse.com 26 May '24

26 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1221438 Bug ID: 1221438 Summary: trash_kcm conflicts kio-core Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: thomas.rahimi(a)mailbox.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello, in the freshly updated OpenSUSE Tumbleweed version 20240311, the trash_kcm plugin for dolphin is missing in my installation. An attempt to install the plugin leads to the message, that this conflicts kio-core and thus would lead to the removal of the overall desktop environment. I'm by far not an expert in KDE Plasma packaging, but I suspect this dependency may be resolved without leading to this conflict. Looking forward to a resolution, if any is possible Kind regards Thomas -- You are receiving this mail because: You are on the CC list for the bug.

1 10