May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1213495] New: Mariadb: InnoDB: Unable to find charset-collation for X
by bugzilla_noreply＠suse.com 08 Aug '24

08 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1213495 Bug ID: 1213495 Summary: Mariadb: InnoDB: Unable to find charset-collation for X Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: suse(a)rettich.bayern QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- There is an upstream bug in Mariadb 11.0.2 (currently distributed in Tumbleweed): https://jira.mariadb.org/browse/MDEV-31443 The bug prevents Mariadb to successfully upgrade from 10 to 11 on database that contains older tables. Can you upgrade the package in the Tumbleweed repository to 11.0.3? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1225317] New: AUDIT-0: systemd: Please review the new DBUS /polkit stuff brought by v256
by bugzilla_noreply＠suse.com 07 Aug '24

07 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225317 Bug ID: 1225317 Summary: AUDIT-0: systemd: Please review the new DBUS /polkit stuff brought by v256 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello, The next major version of system (v256) will come with a host of new features and thus a bunch of methods/actions to review. Could you please review them ? I created the following project that will be used as the devel project for v256: https://build.opensuse.org/package/live_build_log/home:fbui:systemd:v256/sy… You should find the build logs there where the list of methods/actions to review is detailed. Please note that the integration is still WIP hence most of the new stuff has been temporarily packaged in the systemd-experimental subpackage. But some of them will be moved in different subpackages once the integration will be finished. Thanks in advance. -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1214053] New: Wrong Permissions for Package xmrig-6.18.1-bp155.1.8.x86_64.rpm (Download Error)
by bugzilla_noreply＠suse.com 07 Aug '24

07 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1214053 Bug ID: 1214053 Summary: Wrong Permissions for Package xmrig-6.18.1-bp155.1.8.x86_64.rpm (Download Error) Classification: openSUSE Product: openSUSE Backports Version: SLE-15-SP5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Packages Assignee: packagehub-bugs(a)suse.com Reporter: stephan.kreuz(a)bwi.de QA Contact: packagehub-bugs(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Sine 07/01/23 (not sure when problem occure first Time) I get Permission denied for Package xmrig-6.18.1-bp155.1.8.x86_64.rpm from suse-packagehub-15-sp5-backports-pool-x86_64(-sap). Please verify that the correct Permisions set for that Package. kind regards Stephan -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1224308] New: VUL-0: CVE-2024-4068: traefik: the npm package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion
by bugzilla_noreply＠suse.com 07 Aug '24

07 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224308 Bug ID: 1224308 Summary: VUL-0: CVE-2024-4068: traefik: the npm package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405385/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: gabriele.sonnu(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4068 https://www.cve.org/CVERecord?id=CVE-2024-4068 https://devhub.checkmarx.com/cve-details/CVE-2024-4068/ https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5d… https://github.com/micromatch/braces/issues/35 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1217488] New: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1217488 Bug ID: 1217488 Summary: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Filesystems Assignee: nfbrown(a)suse.com Reporter: petr.vorel(a)suse.com QA Contact: petr.vorel(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Although we start due #1217128 testing via cdmackay/pynfs.git, which has fix for "nfs4lib.BadCompoundRes: operation OP_SETCLIENTID should return NFS4_OK [1], instead got NFS4ERR_DELAY", we still get 9 tests failing with this error on Tumbleweed. Any idea what could be wrong now? O I can ask Calum Mackay on linux-nfs if you're busy with more important stuff. [1] https://git.linux-nfs.org/?p=cdmackay/pynfs.git;a=commit;h=0d4d3fd0bb7a6386… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1224149] New: [SELinux] sdbootutil (snapperd_t) failes to execute systemd-pcrlock (init_exec_t)
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224149 Bug ID: 1224149 Summary: [SELinux] sdbootutil (snapperd_t) failes to execute systemd-pcrlock (init_exec_t) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: arvidjaar(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE MicroOS 10:~ # sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 10:~ # zypper info selinux-policy Loading repository data... Reading installed packages... Information for package selinux-policy: --------------------------------------- Repository : openSUSE-Tumbleweed-Oss Name : selinux-policy Version : 20240321-1.2 Arch : noarch Vendor : openSUSE Installed Size : 24.8 KiB Installed : Yes (automatically) Status : up-to-date Source package : selinux-policy-20240321-1.2.src Upstream URL : https://github.com/fedora-selinux/selinux-policy.git Summary : SELinux policy configuration Description : SELinux Reference Policy. A complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. 10:~ # rpm -q sdbootutil sdbootutil-1+git20240506.573a6a4-1.1.x86_64 10:~ # rpm -qf /usr/lib/systemd/systemd-pcrlock systemd-experimental-255.4-3.1.x86_64 10:~ # ls -l /etc/systemd/tpm2-pcr-public-key.pem /etc/systemd/tpm2-pcr-private-key.pem ls: cannot access '/etc/systemd/tpm2-pcr-public-key.pem': No such file or directory ls: cannot access '/etc/systemd/tpm2-pcr-private-key.pem': No such file or directory 10:~ # sdbootutil defaults to systemd-pcrlock if is is present and no previous keypair for the signed policy is present. 10:~ # semodule -DB 10:~ # systemctl start snapper-cleanup.service 10:~ # semodule -B 10:~ # ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts boot ---- time->Sun May 12 08:54:27 2024 type=AVC msg=audit(1715493267.232:132): avc: denied { execute } for pid=1325 comm="sdbootutil" name="systemd-pcrlock" dev="dm-0" ino=57169 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0 ---- time->Sun May 12 08:54:27 2024 type=AVC msg=audit(1715493267.232:133): avc: denied { execute } for pid=1325 comm="sdbootutil" name="systemd-pcrlock" dev="dm-0" ino=57169 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0 10:~ # Other denials for snapper_t are list in boo#1224120 for which I have local policy override. -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1223435] New: Get "nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-core-2.36.0-150200.9.3.2.noarch" error messsage during updates
by bugzilla_noreply＠suse.com 05 Aug '24

05 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1223435 Bug ID: 1223435 Summary: Get "nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-core-2.36.0-150200.9.3.2.noarch" error messsage during updates Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Cloud:Tools Assignee: public-cloud-maintainers(a)suse.de Reporter: kvanderveer(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874524 --> https://bugzilla.suse.com/attachment.cgi?id=874524&action=edit Error from the UI When I run the update from KDE UI in the system tray, I get the following error: nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-core-2.36.0-150200.9.3.2.noarch I've poked around, and tried a recommendation to install the azure-cli from CloudTools. I've got the 2.17.1 version of the azure-cli. When I ran the install, I got: Reading installed packages... There is an update candidate for 'azure-cli' from vendor 'obs://build.opensuse.org/Cloud', while the current vendor is 'SUSE LLC <https://www.suse.com/>'. Use 'zypper install azure-cli-2.59.0-144.4.noarch' to install this candidate. Resolving package dependencies... Problem: 1: nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-2.36.0-150200.9.3.2.noarch Solution 1: do not install azure-cli-2.36.0-150200.9.3.2.noarch Solution 2: break azure-cli-2.36.0-150200.9.3.2.noarch by ignoring some of its dependencies I just canceled out. But I did try to install the 2.59.0 version, and essentially got the same thing. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1225397] New: postfix gives warnings about deprecated parameters
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225397 Bug ID: 1225397 Summary: postfix gives warnings about deprecated parameters Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: freek(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- postfix gives warnings about deprecated parameters May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtp_enforce_tls" will be removed; instead, specify "smtp_tls_security_level" May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtpd_enforce_tls" will be removed; instead, specify "smtpd_tls_security_level" May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtp_use_tls" will be removed; instead, specify "smtp_tls_security_level" May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtpd_use_tls" will be removed; instead, specify "smtpd_tls_security_level" These parameters are introduced in /sbin/config.postfix The attached patch file removes this introduction, the replacements are already present in config.postfix. Also a bug in the naming of backups in /var/adm/backups/postfix is addressed. In principle "$POSTFIX_SMTP_TLS_CLIENT" == "must" should not be expanded in $PCONF -e "smtp_tls_security_level = encrypt". This is a global definition. It should be expanded in smtp_tls_policy_maps = lmdb:/etc/postfix/tls_policy and only for specific destinations in /etc/postfix/tls_policy. So the possibility "must" should be accompanied by specific destinations. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1219363] New: [SELinux] AVC denial execmem ModemManager
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1219363 Bug ID: 1219363 Summary: [SELinux] AVC denial execmem ModemManager Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Just what I found in ausearch -m AVC output: mitmanek:~ # ausearch -m AVC -ts boot |grep ModemManager type=AVC msg=audit(1706651142.962:84): avc: denied { execmem } for pid=1618 comm="ModemManager" scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permissive=1 type=AVC msg=audit(1706651143.909:85): avc: denied { execmem } for pid=1618 comm="ModemManager" scontext=system_u:system_r:modemmanager_t:s0 tcontext=system_u:system_r:modemmanager_t:s0 tclass=process permissive=1 I don’t use ModemManager for anything, so I cannot test whether anything actually changed with functionality. openSUSE/Tumbleweed and mitmanek:~ # sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 mitmanek:~ # -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1222825] New: VUL-0: CVE-2024-28869: traefik: denial of service
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222825 Bug ID: 1222825 Summary: VUL-0: CVE-2024-28869: traefik: denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401695/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28869 https://www.cve.org/CVERecord?id=CVE-2024-28869 https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d2… https://github.com/traefik/traefik/releases/tag/v2.11.2 https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5 https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw https://bugzilla.redhat.com/show_bug.cgi?id=2274987 -- You are receiving this mail because: You are on the CC list for the bug.

1 4