May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1222314] New: YaST doesn't set zypper locales during installation
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1222314 Bug ID: 1222314 Summary: YaST doesn't set zypper locales during installation Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: fvogt(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 874066 --> https://bugzilla.suse.com/attachment.cgi?id=874066&action=edit YaST installation logs I installed YaST with German locale. While the system has the locale configured as expected (e.g. /etc/locale.conf), zypper does not: ~> sudo zypper locales Code | Language | Requested -----+----------+---------- As a result, language specific packages are missing. -- You are receiving this mail because: You are on the CC list for the bug.

1 51

[Bug 1212877] New: [RPi4] cannot wake up after suspend triggered
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1212877 Bug ID: 1212877 Summary: [RPi4] cannot wake up after suspend triggered Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 867900 --> https://bugzilla.suse.com/attachment.cgi?id=867900&action=edit yast2 logs ssh to my RPi 4 Model B, later I see following -- p200300ea3707b36b055205817bcf9853:~ # Broadcast message from root@localhost (Fri 2023-06-30 06:03:37 UTC): The system will suspend now! -- then I try to wake it up by hitting keyboard and click on mouse, nothing happened on screen. attache yast2logs. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1224150] New: [Build 20240511] boot_encrypt: grub does not ask for encryption key
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1224150 Bug ID: 1224150 Summary: [Build 20240511] boot_encrypt: grub does not ask for encryption key Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/4179275/modules/boot _encrypt/steps/2 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation Grub no longer asks for the decryption key. The snapshot contained a grub2 change: +- Fix gcc error with CFLAGS=-Og + * grub2-grubenv-in-btrfs-header.patch + Which sounds harmless there were also plymouth changes, but the failure seems too early for plymouth openQA test in scenario opensuse-Tumbleweed-NET-x86_64-lvm-encrypt-separate-boot@64bit fails in [boot_encrypt](https://openqa.opensuse.org/tests/4179275/modules/boot_encryp… ## Test suite description Same as lvm-full-encrypt, but with separate boot not encrypted partition. Maintainer: riafarov INSTALLONLY=1 UNENCRYPTED_BOOT=1 DESKTOP=gnome ENCRYPT=1 FULL_LVM_ENCRYPT=1 ## Reproducible Fails since (at least) Build [20240509](https://openqa.opensuse.org/tests/4172240) ## Expected result Last good: [20240508](https://openqa.opensuse.org/tests/4169788) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1212947] New: Disable fbdev userspace interfaces and programs
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1212947 Bug ID: 1212947 Summary: Disable fbdev userspace interfaces and programs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: tzimmermann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- We want to remove fbdev from kernel and userspace as far as possible. Linux 6.6 will allow us to disable fbdev's userspace interfaces, most noteably /dev/fb*. Enable this feature in the TW kernel. Framebuffer support has been an endless source of bugs. Not giving userspace access to it's internals and framebuffer memory will close a possible entry point for all sorts of malware. Please note that the framebuffer console is implemented entirely within the kernel and will not be affected by this change. -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1225296] New: Dual monitor not recognised after upgrade 15.5 to 15.6
by bugzilla_noreply＠suse.com 15 Dec '24

15 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1225296 Bug ID: 1225296 Summary: Dual monitor not recognised after upgrade 15.5 to 15.6 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: martin.schmidt(a)io-warnemuende.de QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Moin, moin, I am using openSUSE 15.5 on an old intel based x86 PC, equipped with a simple nvidia gforce and two monitors. The monitors are using a displayport connnection from the graphics card to the monitors via an Y-shaped cable. Both monitors are recognised correctly and can be configured to form a single graphical work space, when the system is up and running. After upgrading to openSUSE 15.6 this does not work any more. When booting, monitor 1 shows some firmware screen and the openSUSE boot screen, where the OS version (several subversions of 15.6 and frozen snapshots of 15.5) can be selected. Using the default option (15.6 from harddrive), the output of the boot process is moving to monitor 2, but monitor 1 is going to a "power saving sleep mode" and stays inactive frome here on. The boot process is finished correctly with monitor 2 as the only graphical device. Monitor 1 cannot be activated again. Switching off monitor 2 before booting, the system comes up without any valid output device. Monitor 1 goes to sleep after the system boot started. I did not check the system status with a remote ssh-connection yet. Switching off monitor 1 before booting, lets the system come up completely with monitor 2. Also the initial hardware screen is diplayerd there. In turn, booting from a read-only snapshot with openSUSE 15.5, both monitors are used as before. The nouveau-dri drivers are used, no propriatary nvidia driver is installed. Some upgrade history: - just to test, if the few graphic card cores could be used in a cuda environment, cuda was installed under 15.5. This failed and cuda was deinstalled. However, when upgrading later from 15.5 to 15.6 the cuda development environment was reinstalled automatically together with nvidia drivers. As a result the nvidia drivers allowed only for a single low resolution vga monitor. May be, this happened, since the nvidia repository was not deleted and there was some leftover from the cuda test. - with the ascii-yast the nvidia drivers (gforce003/004) and cuda could be removed and the nouveau-dri drivers where reinstalled - together with dependencies. This allows for a single monitor OS_15.6 system with high resolution, but the second monitor (monitor 1) is lost during the boot process as described above. Before I try to install from scratch just with the hope that the error goes away, I am reporting this strange behaviour here. May be, this helps to streamline the distribution. Any hints are very welcome - especially how to modify the bootloader options. Cheers, Martin Schmidt -- You are receiving this mail because: You are on the CC list for the bug.

1 32

[Bug 1220088] New: Hibernate completes shuts machine off *then* machine automatically turns back on.
by bugzilla_noreply＠suse.com 14 Dec '24

14 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1220088 Bug ID: 1220088 Summary: Hibernate completes shuts machine off *then* machine automatically turns back on. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: pj.opensuse(a)gmx.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi, when hibernate is envoked from the Tumbleweed menu the hibernate feature seems to complete and shutoff the machine for 2 seconds...... Then the machine automatically powers back on. I enter the LUKS password and the machine continues to boot. I enter the user password at SDDM screen. After loading KDE I can then see that Hibernate has indeed worked. Largest issue is machine is cycling, (powering back on) after hibernation has been envoked. I have shut off all wake-on power options in the bios settings. The machine is kept very current with the latest updates. What are your thoughts on this? -Best Regards -- You are receiving this mail because: You are on the CC list for the bug.

1 25

[Bug 1225688] New: [tw] [hexchat] gnome-shell The program 'hexchat' received an X Window System error when connecting to netwok
by bugzilla_noreply＠suse.com 13 Dec '24

13 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1225688 Bug ID: 1225688 Summary: [tw] [hexchat] gnome-shell The program 'hexchat' received an X Window System error when connecting to netwok Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 URL: https://openqa.opensuse.org/tests/4236088/modules/hexc hat/steps/28 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: richard.fan(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Description The issue is a sporadic one, but I can see the issue several times in openQA automation tests. it can be seen on both x86_64 and aarch64 platforms. Steps to reproduce the issue: 1. Upgrade the system from leap15.x to tw 2. start hexchat 3. config a nickname and connect to "Libera.Chat" Error logs like below: >May 30 09:49:37.300575 susetest gnome-shell[30709]: The program 'hexchat' received an X Window System error. >May 30 09:49:37.300575 susetest gnome-shell[30709]: This probably reflects a bug in the program. >May 30 09:49:37.307179 susetest gnome-shell[30709]: The error was 'BadWindow (invalid Window parameter)'. >May 30 09:49:37.307179 susetest gnome-shell[30709]: (Details: serial 6056 error_code 3 request_code 38 minor_code 0) >May 30 09:49:37.307179 susetest gnome-shell[30709]: (Note to programmers: normally, X errors are reported asynchronously; >May 30 09:49:37.307179 susetest gnome-shell[30709]: that is, you will receive the error a while after causing it. >May 30 09:49:37.307179 susetest gnome-shell[30709]: To debug your program, run it with the --sync command line >May 30 09:49:37.307179 susetest gnome-shell[30709]: option to change this behavior. You can then get a meaningful >May 30 09:49:37.307179 susetest gnome-shell[30709]: backtrace from your debugger if you break on the gdk_x_error() function.) Please refer to the attached log for more information. ## openQA Observation as below: openQA test in scenario opensuse-Tumbleweed-NET-aarch64-zdup-Leap-15.5-gnome@aarch64 fails in [hexchat](https://openqa.opensuse.org/tests/4236088/modules/hexchat/steps/28) ## Test suite description Maintained by qe-core ## Reproducible Fails since (at least) Build [20240529](https://openqa.opensuse.org/tests/4235968) ## Expected result Last good: (unknown) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=aarch64&distri=opensu… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1224773] New: Cannot install NVIDIA drivers in latest Aeon RC2
by bugzilla_noreply＠suse.com 12 Dec '24

12 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1224773 Bug ID: 1224773 Summary: Cannot install NVIDIA drivers in latest Aeon RC2 Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: rbrown(a)suse.com Reporter: sunscape1(a)hotmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Installing NVIDIA drivers in Aeon RC2 (https://en.opensuse.org/SDB:NVIDIA_drivers) fails because the MOK cannot be enrolled after boot. Error during installation using pkg is: SKIP: /var/lib/nvidia-pubkeys/MOK-nvidia-driver-G06-550.78-22.1-default.der is not in MokList Without the nvidia-pubkeys folder it is impossible to enroll the MOK or try to enable it after reboot. The key doesn't exist :( -- You are receiving this mail because: You are on the CC list for the bug.

1 38