May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224327] "Client hit max requests limit 1" during live migrations
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224327 https://bugzilla.suse.com/show_bug.cgi?id=1224327#c8 James Fehlig <jfehlig(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Assignee|kvm-bugs(a)suse.de |jfehlig(a)suse.com Status|NEW |RESOLVED --- Comment #8 from James Fehlig <jfehlig(a)suse.com> --- (In reply to Lin Ma from comment #7) Hi Lin, Thanks for helping with this bug while I was on vacation! > @Jim, The issue can be fixed by libvirt upstream commit b3f8e072. > Could you please help to backport it into SLE15SP5 and leap 15.5? I've added b3f8e072 to the SLE15 SP5 libvirt package and submitted it for maintenance. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225525] New: Aeon is too boring
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225525 Bug ID: 1225525 Summary: Aeon is too boring Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: rbrown(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Originally reported on https://www.reddit.com/r/openSUSE/s/tBiZiuVaBd /u/mwyvr reports: “I've discovered a serious problem but there's no category in Bugzilla for it. All this auto-updating and atomic-core and containerized user apps makes Aeon so much less thrilling. I've been running it for months without any hiccups. Working-as-designed. Maybe I'll write a system-breakage-simulation app just to give people some thrills, like a Pomodoro app but with tension.” -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1224369] kernel-longterm only built for x86_64
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224369 https://bugzilla.suse.com/show_bug.cgi?id=1224369#c2 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #2 from Robert Frohl <rfrohl(a)suse.com> --- submitted: https://build.opensuse.org/request/show/1177387 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223858] Cannot mount kerberized nfs4 share with kernel 5.14.21-150500.55.59-default
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223858 https://bugzilla.suse.com/show_bug.cgi?id=1223858#c18 --- Comment #18 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-SU-2024:1801-1: An update that has three security fixes can now be installed. Category: security (important) Bug References: 1223858, 1224169, 1224340 Maintenance Incident: [SUSE:Maintenance:34026](https://smelt.suse.de/incident/34026/) Sources used: openSUSE Leap 15.5 (src): kernel-syms-azure-5.14.21-150500.33.54.1, kernel-source-azure-5.14.21-150500.33.54.1 Public Cloud Module 15-SP5 (src): kernel-syms-azure-5.14.21-150500.33.54.1, kernel-source-azure-5.14.21-150500.33.54.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c21 --- Comment #21 from Jonas Kvinge <jonaski(a)opensuse.org> --- The following drivers seem to be missing on Tumbleweed, but exists on Leap: dracut: drwxr-xr-x 3 root root 0 May 28 12:37 lib/modules/5.14.21-150500.55.65-default/kernel/drivers/video/fbdev dracut: drwxr-xr-x 2 root root 0 May 28 12:37 lib/modules/5.14.21-150500.55.65-default/kernel/drivers/video/fbdev/core dracut: -rw-r--r-- 1 root root 2672 May 23 10:43 lib/modules/5.14.21-150500.55.65-default/kernel/drivers/video/fbdev/core/fb_sys_fops.ko.zst dracut: -rw-r--r-- 1 root root 3445 May 23 10:43 lib/modules/5.14.21-150500.55.65-default/kernel/drivers/video/fbdev/core/syscopyarea.ko.zst dracut: -rw-r--r-- 1 root root 3790 May 23 10:43 lib/modules/5.14.21-150500.55.65-default/kernel/drivers/video/fbdev/core/sysfillrect.ko.zst dracut: -rw-r--r-- 1 root root 3208 May 23 10:43 lib/modules/5.14.21-150500.55.65-default/kernel/drivers/video/fbdev/core/sysimgblt.ko.zst I'm guessing that's the cause. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c20 --- Comment #20 from Jonas Kvinge <jonaski(a)opensuse.org> --- This line is on Leap, but missing on Tumbleweed: <6>[ 3.497912] fb0: switching to vc4 from EFI VGA -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223260] SELinux denies pcp
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223260 https://bugzilla.suse.com/show_bug.cgi?id=1223260#c9 Cathy Hu <cathy.hu(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|cathy.hu(a)suse.com |ddiss(a)suse.com --- Comment #9 from Cathy Hu <cathy.hu(a)suse.com> --- hmm, maybe i am missing something, but i don't think the changes are in factory yet, i only see them in Base:System/pcp. see diff between Base:System/pcp and factory: https://build.opensuse.org/package/rdiff/Base:System/pcp?opackage=pcp&oproj… the fix is in the newly introduced pcp-selinux package which i can not find yet in factory yet setting @ddiss as assignee to submit to factory, please feel free to assign back to me if i misunderstood or it is still broken after that thanks :) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c19 --- Comment #19 from Jonas Kvinge <jonaski(a)opensuse.org> --- I don't see what module I'm looking for here, but I've attached the logs from both Leap and Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c18 --- Comment #18 from Jonas Kvinge <jonaski(a)opensuse.org> --- Created attachment 875165 --> https://bugzilla.suse.com/attachment.cgi?id=875165&action=edit dracut output from tumbleweed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c17 --- Comment #17 from Jonas Kvinge <jonaski(a)opensuse.org> --- Created attachment 875164 --> https://bugzilla.suse.com/attachment.cgi?id=875164&action=edit dracut output from leap -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c16 --- Comment #16 from Jonas Kvinge <jonaski(a)opensuse.org> --- Created attachment 875163 --> https://bugzilla.suse.com/attachment.cgi?id=875163&action=edit boot.msg from tumbleweed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c15 --- Comment #15 from Jonas Kvinge <jonaski(a)opensuse.org> --- Created attachment 875162 --> https://bugzilla.suse.com/attachment.cgi?id=875162&action=edit boot.msg from leap -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225509] New: AUDIT-FIND: 4Pane: predictable /tmp path in PreviewPopup::DisplayImage
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225509 Bug ID: 1225509 Summary: AUDIT-FIND: 4Pane: predictable /tmp path in PreviewPopup::DisplayImage Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- 4Pane uses predictable /tmp paths in PreviewPopup::DisplayImage() > 2054 pngfilepath = "/tmp/" + fn.GetName() + ".png"; > 2055 if (SvgToPng(filepath, pngfilepath, handle)) > 2056 image = wxImage(pngfilepath); > 2057 wxRemoveFile(pngfilepath); If fs.protected_symlinks=1, an unprivileged user can prevent 4Pane from displaying previews for SVG images. If fs.protected_symlinks=0, an unprivileged user can overwrite arbitrary world-readable files owned by the 4Pane user. Steps to reproduce: nobody@localhost:/tmp> ln -s /home/user/somefile foo.png # ... wait until the user previews a file named foo.svg # somefile will be overwritten An attacker can pre-create symlinks for the names of all existing SVG files on the system to increase the likelihood of triggering the bug. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223578] New: Ensure that all %ghost entries have %attr() matching the final permissions (e.g. from systemd-tmpfiles)
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223578 Bug ID: 1223578 Summary: Ensure that all %ghost entries have %attr() matching the final permissions (e.g. from systemd-tmpfiles) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- just an example ``` rpm -qlv pipewire | grep /var/lib/pip d--------- 2 root root 0 Apr 17 08:56 /var/lib/pipewire ---------- 1 root root 0 Apr 17 08:56 /var/lib/pipewire/pipewire_post_workaround ``` this then causes unneeded noise e.g. in `rpm -V pipewire` ``` rpm -V pipewire .M....... g /var/lib/pipewire ``` 1. all %ghost entries should come with %attr() ``` %ghost %attr(0644,root,root) %config(noreplace) /etc/apparmor.d/local/%{name} ``` 2. rpmlint check that errors out if the permissions bits for an entry are set to 000 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1225146] devel:languages:nodejs/nodejs20: Bug "Internal Error: not found: corepack"
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225146 https://bugzilla.suse.com/show_bug.cgi?id=1225146#c1 Adam Majer <amajer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Product|openSUSE.org |openSUSE Tumbleweed Component|3rd party software |Other Resolution|--- |FIXED Version|unspecified |Current Target Milestone|--- |Current QA Contact|screening-team-bugs(a)suse.de |qa-bugs(a)suse.de --- Comment #1 from Adam Majer <amajer(a)suse.com> --- Fix for nodejs-common is submitted to Factory that will change the "not found" to something that seems to be working. It may take a few days as it also changes default version of nodejs to 22.x It's not part of nodejs in SLE since customers haven't requested it and it's just a thin layer that downloads the actual code from internet. You are first person to report actually trying to use corepack (aside from the contribution to enable it earlier this year). :-) Thanks for bug report. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210505] VUL-0: CVE-2023-29013: traefik,traefik1.7: HTTP header parsing DoS
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1210505 https://bugzilla.suse.com/show_bug.cgi?id=1210505#c3 Carlos López <carlos.lopez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #3 from Carlos López <carlos.lopez(a)suse.com> --- Done, closing. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1217807] New: VUL-0: CVE-2023-47633: traefik: 100% CPU usage when self-serving as backend
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217807 Bug ID: 1217807 Summary: VUL-0: CVE-2023-47633: traefik: 100% CPU usage when self-serving as backend Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386934/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47633 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217804] New: VUL-0: CVE-2023-47106: traefik: incorrect processing of fragment in the URL leads to authorization bypass
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217804 Bug ID: 1217804 Summary: VUL-0: CVE-2023-47106: traefik: incorrect processing of fragment in the URL leads to authorization bypass Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386931/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47106 https://github.com/traefik/traefik/releases/tag/v2.10.6 https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217806] New: VUL-0: CVE-2023-47124: traefik: Potential DDoS whith ACME HTTPChallenge
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217806 Bug ID: 1217806 Summary: VUL-0: CVE-2023-47124: traefik: Potential DDoS whith ACME HTTPChallenge Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/386932/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-47124 https://doc.traefik.io/traefik/https/acme/#dnschallenge https://github.com/traefik/traefik/releases/tag/v2.10.6 https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c14 --- Comment #14 from Takashi Iwai <tiwai(a)suse.com> --- Please read what Jiri suggested in comment 6. The problem is likely some missing modules in initrd, and those need to be listed somehow manually for RPi. You can put the missing modules by creating a config snippet in /etc/dracut.conf.d/* file. (See dracut.conf man page for details.) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c13 --- Comment #13 from Jonas Kvinge <jonaski(a)opensuse.org> --- Hi. I have the same issue on a RPI CM4 with Tumbleweed. The Plymouth image does not show on boot, but works on reboot/shutdown. I've also tested the same Plymoth theme on openSUSE Leap 15.5 and there it works fine. I can't access http://bugzilla.opensuse.org/show_bug.cgi?id=1132086 Any suggestions what to try? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1215172] VUL-0: croc: multiple security issues in croc
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1215172 https://bugzilla.suse.com/show_bug.cgi?id=1215172#c15 --- Comment #15 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Not in a hurry. Dropped from Leap too so we are good -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223986] conflicting package gets selected during zypper dup
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223986 https://bugzilla.suse.com/show_bug.cgi?id=1223986#c1 Dominique Leuenberger <dimstar(a)opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dimstar(a)opensuse.org --- Comment #1 from Dominique Leuenberger <dimstar(a)opensuse.org> --- The error is in 'Obsoletes' If pkg B obsoleted pkg A, then B is always picked 'to step in place of A'. Packaging bug (on PM. the Videolan repository does not have this obsoleted in the package) in your case, you do not want to have the obsoletes in vlc-beta -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224053] installation-images: eliminate usage of xiterm
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224053 https://bugzilla.suse.com/show_bug.cgi?id=1224053#c33 --- Comment #33 from Stefan Hundhammer <shundhammer(a)suse.com> --- SR to OBS: https://build.opensuse.org/request/show/1177300 This will become available with yast2-installation-5.0.11. (Factory / Tumbleweed only, no SLE-15-SPx / SLE-12-SPx). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222086] zypper as non-root always reports repositories are out-of-date (regression)
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222086 https://bugzilla.suse.com/show_bug.cgi?id=1222086#c23 --- Comment #23 from Andrei Borzenkov <arvidjaar(a)gmail.com> --- (In reply to Michael Andres from comment #17) > The original behavior is restored in zypper-1.14.73 No, it is not restored. Now zypper as non-root is completely silent and does not inform user that repositories are out of date. https://bugzilla.opensuse.org/show_bug.cgi?id=1225451 -- You are receiving this mail because: You are on the CC list for the bug.

1 0