May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1047218] trackerbug: packages do not build reproducibly from including build time
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1047218 Bug 1047218 depends on bug 1217704, which changed state. Bug 1217704 Summary: ovmf: reproducible builds problem in ovmf-riscv64-code.bin https://bugzilla.suse.com/show_bug.cgi?id=1217704 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1217704] ovmf: reproducible builds problem in ovmf-riscv64-code.bin
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217704 https://bugzilla.suse.com/show_bug.cgi?id=1217704#c14 Bernhard Wiedemann <bwiedemann(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #14 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- Let's count it as fixed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222927] lxc fails to build on Leap 15.6 [m[Kpassing argument 4 of '[01m[Kmount_setattr[m[K' from incompatible pointer type [[01;31m[K-Werror=incompatible-pointer-types[m[K]
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222927 https://bugzilla.suse.com/show_bug.cgi?id=1222927#c3 --- Comment #3 from Johannes Kastl <opensuse_buildservice(a)ojkastl.de> --- Hi Max, try version 6.0.0: https://build.opensuse.org/package/show/Virtualization:containers/lxc Already accepted to Factory, see https://build.opensuse.org/request/show/1171111 I fixed the builds for 15.x there, as there is a mismatch in the path to the directory. Kind Regards, Johannes -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1220571] [META] Packages failing because GCC 14+ treats some warnings as errors
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1220571 Michal Suchanek <msuchanek(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1223886 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223884] New: VUL-0: CVE-2024-34063: iamb: vodozemac: degraded secret zeroization capabilities
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223884 Bug ID: 1223884 Summary: VUL-0: CVE-2024-34063: iamb: vodozemac: degraded secret zeroization capabilities Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/404259/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: okurz(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1223881 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1223881 +++ vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34063 https://www.cve.org/CVERecord?id=CVE-2024-34063 https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54… https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1223882] New: VUL-0: CVE-2024-34063: fractal: vodozemac: degraded secret zeroization capabilities
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223882 Bug ID: 1223882 Summary: VUL-0: CVE-2024-34063: fractal: vodozemac: degraded secret zeroization capabilities Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/404259/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: os.gnome.maintainers(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Depends on: 1223881 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1223881 +++ vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34063 https://www.cve.org/CVERecord?id=CVE-2024-34063 https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54… https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1223881] New: VUL-0: CVE-2024-34063: TRACKERBUG: vodozemac: degraded secret zeroization capabilities
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223881 Bug ID: 1223881 Summary: VUL-0: CVE-2024-34063: TRACKERBUG: vodozemac: degraded secret zeroization capabilities Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/404259/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies (the Dalek crates), which moved secret zeroization capabilities behind a feature flag and defaulted this feature to off. The degraded zeroization capabilities could result in the production of more memory copies of encryption secrets and secrets could linger in memory longer than necessary. This marginally increases the risk of sensitive data exposure. This issue has been addressed in version 0.6.0 and users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34063 https://www.cve.org/CVERecord?id=CVE-2024-34063 https://github.com/matrix-org/vodozemac/commit/297548cad4016ce448c4b5007c54… https://github.com/matrix-org/vodozemac/security/advisories/GHSA-c3hm-hxwf-… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1202431] windows:mingw:win{32|64}/mingw{32|64}-filesystem: Enormous amount of time needed to scan binaries for debug source files
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1202431 https://bugzilla.suse.com/show_bug.cgi?id=1202431#c14 --- Comment #14 from Ralf Habacker <ralf.habacker(a)freenet.de> --- I just saw at https://www.prevanders.net/dwarf.html#introduction, that there is a dwarfdump tool available, which can read PE files https://www.prevanders.net/dwarf.html#libdwarf-20190104 I did a quick test to see what the differences are compared to the current solution: osc co windows:mingw:win32/mingw32-libvsg && cd $_ osc build openSUSE_Leap_15.5 time find /home/osc/build-root/openSUSE_Leap_15.5-x86_64/home/abuild/rpmbuild/BUILD/VulkanSceneGraph-1.0.9/ -name '*.dll' | xargs objdump -Wi | /usr/bin/i686-w64-mingw32-objdump-srcfiles > /dev/null real 0m15,122s user 0m23,000s sys 0m0,723s Most of the time is spent analyzing the binary file with objdump: time find /home/osc/build-root/openSUSE_Leap_15.5-x86_64/home/abuild/rpmbuild/BUILD/VulkanSceneGraph-1.0.9/ -name '*.dll' | xargs objdump -Wi > /dev/null real 0m14,426s user 0m14,234s sys 0m0,187s And now the same with dwarfdump, which was built in release mode: time find /home/osc/build-root/openSUSE_Leap_15.5-x86_64/home/abuild/rpmbuild/BUILD/VulkanSceneGraph-1.0.9/ -name '*.dll' | xargs ../libdwarf-code-build/src/bin/dwarfdump/dwarfdump -i > /dev/null real 0m26,076s user 0m25,212s sys 0m0,490s It takes about 1.85 times more time than the current solution. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223857] updates fail like MS does
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223857 https://bugzilla.suse.com/show_bug.cgi?id=1223857#c1 Lukas Ocilka <locilka(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|AutoYaST |Other Assignee|yast2-maintainers(a)suse.de |screening-team-bugs(a)suse.de --- Comment #1 from Lukas Ocilka <locilka(a)suse.com> --- https://en.opensuse.org/openSUSE:How_to_Write_a_Good_Bugreport -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223853] podman doesn't display pasta version
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223853 https://bugzilla.suse.com/show_bug.cgi?id=1223853#c1 Dan Čermák <dcermak(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|containers-bugowner(a)suse.de |dcermak(a)suse.com Status|NEW |CONFIRMED CC| |containers-bugowner(a)suse.de --- Comment #1 from Dan Čermák <dcermak(a)suse.com> --- This is a bug in the passt spec, should be fixed via https://build.opensuse.org/request/show/1171759 -- You are receiving this mail because: You are on the CC list for the bug.

1 0