May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225407] New: GNU tar hangs when extracting certain symlinks
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225407 Bug ID: 1225407 Summary: GNU tar hangs when extracting certain symlinks Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: psychonaut(a)nothingisreal.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The version of GNU tar 1.35 packaged for openSUSE Tumbleweed hangs when using --wildcards to extract a symlink to another file in the archive that does not match the wildcard. The problem may be specific to the openSUSE RPMs; I cannot reproduce it when using GNU tar 1.35 compiled from source. An example of an archive that can reproduce this problem is at <http://files.nothingisreal.com/tmp/news002f1.tar.bz2>. Using the command line tar xavf news002f1.tar.bz2 the archive is successfully extracted. But if I add a --wildcards option such as tar xavf news002f1.tar.bz2 --wildcards '*trek*' then tar hangs when it gets to the file news002f1/b5/net.startrek/24. This file, which matches the wildcard, is a symlink to the file news002f1/b5/net.sf-lovers/141, which does not match the wildcard. Running tar with strace shows that tar gets stuck in a loop: mkdirat(AT_FDCWD, "news002f1", 0755) = -1 EEXIST (File exists) mkdirat(AT_FDCWD, "news002f1/b5", 0755) = -1 EEXIST (File exists) mkdirat(AT_FDCWD, "news002f1/b5/net.startrek", 0755) = -1 EEXIST (File exists) newfstatat(AT_FDCWD, "news002f1/b5/net.startrek", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0 linkat(AT_FDCWD, "news002f1/b5/net.sf-lovers/141", AT_FDCWD, "news002f1/b5/net.startrek/24", 0) = -1 ENOENT (No such file or directory) newfstatat(AT_FDCWD, "news002f1/b5/net.sf-lovers/141", 0x7fffcaca26a0, AT_SYMLINK_NOFOLLOW) = -1 ENOENT (No such file or directory) By contrast, GNU tar 1.35 compiled from source does not hang; it instead emits the error messages of the following sort for the affected symlinks and then continues processing the archive: Cannot hard link to ‘news002f1/b5/net.sf-lovers/141’: No such file or directory -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1217967] New: grub2: verification build issue
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1217967 Bug ID: 1217967 Summary: grub2: verification build issue Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: jlee(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mchang(a)suse.com Target Milestone: --- Found By: --- Blocker: --- While working on reproducible builds for ALP + openSUSE, I found that our grub2 package produced different results when built locally compared to the official Factory build on OBS. My guess is that it comes from https://github.com/openSUSE/pesign-obs-integration filterdiff 'rpm -qp --qf %{PLATFORM}\n' binaries*/grub2-2.12~rc1-12.1.x86_64.rpm --- rpm -qp --qf %{PLATFORM}\n binaries/grub2-2.12~rc1-12.1.x86_64.rpm +++ rpm -qp --qf %{PLATFORM}\n binaries.nachbau/grub2-2.12~rc1-12.1.x86_64.rpm @@ -1 +1 @@ -x86_64-suse-linux +i386-suse-linux-gnu using https://github.com/bmwiedemann/reproducibleopensuse/blob/master/filterdiff Apart from that, there is the (probably unavoidable) sig itself: --- old /usr/share/grub2/x86_64-efi/grub.efi (hex) +++ new /usr/share/grub2/x86_64-efi/grub.efi (hex) @@ -1,6 +1,6 @@ 00000100 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| -00000120 00 00 00 00 00 00 00 00 00 50 1f 00 70 07 00 00 |.........P..p...| +* 00000130 00 30 1f 00 00 20 00 00 00 00 00 00 00 00 00 00 |.0... ..........| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1213659] New: VUL-0: CVE-2023-38496: apptainer: Ineffective privileges drop when requesting container network
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1213659 Bug ID: 1213659 Summary: VUL-0: CVE-2023-38496: apptainer: Ineffective privileges drop when requesting container network Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/373431/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: cgoll(a)suse.com Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38496 https://bugzilla.redhat.com/show_bug.cgi?id=2226582 https://www.cve.org/CVERecord?id=CVE-2023-38496 http://www.cvedetails.com/cve/CVE-2023-38496/ https://github.com/apptainer/apptainer/pull/1523 https://github.com/apptainer/apptainer/pull/1578 https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-w… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1224161] New: firefox menus invisible if fractional scaling enabled
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224161 Bug ID: 1224161 Summary: firefox menus invisible if fractional scaling enabled Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: dpbasti(a)wp.pl QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874831 --> https://bugzilla.suse.com/attachment.cgi?id=874831&action=edit no-scaling-ok When I run 100% scale of my 4k monitor all is fine, changigng to 150% makes extension menus to become invisible. Screenshots attached. Not sure if it is related to firefox, nvidia , wayland or plasma6 plasma 6.0.5 with nvidia prime offload and wayland current tumbleweed -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1218581] New: Version of mesa and mesa-drivers different
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1218581 Bug ID: 1218581 Summary: Version of mesa and mesa-drivers different Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: ecsos(a)schirra.net QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Version of mesa and mesa-drivers different. This means that not a single package can be built in the build service that mesa requires. Message in OBS: The build can not begin, because required packages are either missing or not explicitly defined. Build jobs exist for the repository unresolvable: nothing provides Mesa = 22.3.5 needed by Mesa-dri, (got version 23.3.2-lp156.1520.1) -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1218387] New: VUL-0: CVE-2023-51766: exim: SMTP smuggling attack
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1218387 Bug ID: 1218387 Summary: VUL-0: CVE-2023-51766: exim: SMTP smuggling attack Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/389285/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: poeml(a)cmdline.net Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: meissner(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51766 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223459] New: akregator window cannot be restored from miniature box after login
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1223459 Bug ID: 1223459 Summary: akregator window cannot be restored from miniature box after login Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: benoit.monin(a)gmx.fr QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When akregator is started automatically during login, its main window cannot be restored by clicking on its icon in the miniature box. I created a new user for the test. Here are the steps to reproduce the problem: * Login * Start akregator and close its main window * Confirm that it can be reopened by left-clicking on its icon in the miniature box * Confirm that the "restore" option is available by right-clicking on it (see https://paste.opensuse.org/pastes/7e8061571f27) * Logout and log back in * Akregator is auto-started * Akregator icon is present in the miniature box but legt-clicking does nothing * Right-clicking shows a menu with the "restore" option missing (see https://paste.opensuse.org/pastes/9de44d025751) The work-around is to select quit from the menu then start akregator. It will behave correctly for the current session, until the next login. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1221509] New: Videos flicker during playback, sometimes the video goes black
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221509 Bug ID: 1221509 Summary: Videos flicker during playback, sometimes the video goes black Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: pilotgi(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I've noticed this problem since updating to Plasma 6 and using a Wayland session. I'm attaching a screen recording of an .mp4 file playing in VLC to show the flickering and the black screens. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1224129] New: VUL-0: CVE-2024-3727: singularity-ce: containers/image: digest type does not guarantee valid type
by bugzilla_noreply＠suse.com 19 Jul '24

19 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224129 Bug ID: 1224129 Summary: VUL-0: CVE-2024-3727: singularity-ce: containers/image: digest type does not guarantee valid type Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/404878/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: dimstar(a)opensuse.org Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, cgoll(a)suse.com, eich(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1224112 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1224112 +++ The digest values, handled by the Go library github.com/opencontainers/go-digest and used throughout the Go-implemented containers ecosystem, are not always validated. That allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, resource exhaustion, local path traversal and other attacks. References: https://issues.redhat.com/browse/OCPBUGS-25269 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-3727 https://bugzilla.redhat.com/show_bug.cgi?id=2274767 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1217414] New: changing default umask for new users homedir sets the current umask for ALL users including root
by bugzilla_noreply＠suse.com 19 Jul '24

19 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1217414 Bug ID: 1217414 Summary: changing default umask for new users homedir sets the current umask for ALL users including root Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: joergboe44(a)googlemail.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- When I change the default umask for new users home dir, the umask for all users (including root) is changed after login. This is not what I expect and may be dangerousö. OS version: openSUSE Tumbleweed 20231121 Steps to reproduce: 1. Check the umask setting for a user or root: su --login test2 Password: test2@localhost:~> umask 0022 2. Change the umask for home directory of new users: Yast->User and group management->Defaults for new users: Change umask for home directory to 002 3. Login as a user or root e.g 'su --login' su --login test2 Password: test2@localhost:~> umask 0002 The umask is changed for all users. This bug is almost the same as in Bugzilla – Bug 606249. But the behavior is obviously changed since then. In the current Tumbleweed version the YAST changes the UMASK in file /etc/login.defs.d/70-yast.defs And this seems to be enough to change the umask for the next login. -- You are receiving this mail because: You are on the CC list for the bug.

1 3