May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1220514] New: VUL-0: CVE-2024-1892: python-Scrapy: parts of API are vulnerable to a ReDoS attack
by bugzilla_noreply＠suse.com 11 Jul '24

11 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220514 Bug ID: 1220514 Summary: VUL-0: CVE-2024-1892: python-Scrapy: parts of API are vulnerable to a ReDoS attack Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/395399/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1892 https://www.cve.org/CVERecord?id=CVE-2024-1892 https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b https://docs.scrapy.org/en/latest/news.html#scrapy-2-11-0-2023-09-18 Patch: https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb875… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1224007] New: Package cvs fails to build with GCC 14 because of its new errors (that were previously warnings)
by bugzilla_noreply＠suse.com 10 Jul '24

10 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224007 Bug ID: 1224007 Summary: Package cvs fails to build with GCC 14 because of its new errors (that were previously warnings) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Package cvs does not build with gcc 14 because of its new errors, see bug#1220571 and https://gcc.gnu.org/gcc-14/porting_to.html for more details on these. See failed build log for example here: https://build.opensuse.org/package/live_build_log/home:rguenther:plgrnd/cvs… The failure happens when running configure in the sub-directory cvslock-0.2: [ 36s] checking whether the C compiler (gcc -O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -Werror=return-type -flto=auto -g -pipe -D_GNU_SOURCE -std=gnu99 -flto=auto) works... no [ 36s] configure: error: installation or configuration problem: C compiler cannot create executables. ...which hints that the problem is an ancient autoconf. Because cvs is has not had a release for over a decade and its use is already quite small, switching autoconf seems like unreasonable effort and I'd simply propose to use -fpermissive in this case. On the other hand, note that Fedora claims to have fixed their cvs, see: - https://gitlab.com/fweimer-rh/fedora-modernc/-/blob/main/pkg/c/cvs.md?ref_t… - https://bugzilla.redhat.com/show_bug.cgi?id=2187741 and - https://src.fedoraproject.org/rpms/cvs/c/de3a484fb175576744fe001c75cfa60163… But I guess(!) that cvslock simply is not part of their package. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1220882] New: qemu/kvm install in distrobox / Tumbleweed x86_64 fails in posttrans
by bugzilla_noreply＠suse.com 10 Jul '24

10 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220882 Bug ID: 1220882 Summary: qemu/kvm install in distrobox / Tumbleweed x86_64 fails in posttrans Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello seems like qemu/kvm install inside container (distrobox) is not working as expected. https://en.opensuse.org/Distrobox It seems to detect container as Legacy system, perhaps that's fine, but perhaps it would be fair to treat containers differently. I'm personally not interested in running virt stack inside container, however, they're dependencies pulled as part of sudo zypper in openSUSE-release-tools osc-plugins-staging The host OS is Leap 15.6, however what matters is the containers OS and that's freshly deployed openSUSE Tumbleweed, where the installation raises errors. (292/307) Installing: librbd1-16.2.14.66+g7aa6ce9419f-3.2.x86_64 .........[done] (293/307) Installing: qemu-block-rbd-8.2.1-3.1.x86_64 ....................[done] (294/307) Installing: qemu-tools-8.2.1-3.1.x86_64 ........................[done] (295/307) Installing: qemu-x86-8.2.1-3.1.x86_64 ..........................[done] stat: cannot statx '/proc/1/root/': Permission denied /var/tmp/rpm-tmp.koFhq8: line 2: [: =: unary operator expected (296/307) Installing: qemu-8.2.1-3.1.x86_64 ..............................[done] (297/307) Installing: qemu-ovmf-x86_64-202308-3.5.noarch .................[done] (298/307) Installing: build-20240221-1.1.noarch ..........................[done] (299/307) Installing: build-mkdrpms-20240221-1.1.noarch ..................[done] (300/307) Installing: obs-service-source_validator-0.34-2.1.noarch .......[done] (301/307) Installing: obs-service-download_files-0.9.2-1.3.noarch ........[done] (302/307) Installing: obs-service-format_spec_file-20240121-1.2.noarch ...[done] (303/307) Installing: obs-service-tar_scm-0.10.43-1.1.noarch .............[done] (304/307) Installing: obs-service-obs_scm-0.10.43-1.1.noarch .............[done] (305/307) Installing: osc-1.6.1-1.1.noarch ...............................[done] (306/307) Installing: openSUSE-release-tools-20240223.f941f9d-1.1.noarch .[done] (307/307) Installing: osclib-20240223.f941f9d-1.1.noarch .................[done] %posttrans(kvm_stat-6.7.7-23.3.noarch) script output: Failed to send reload request: Permission denied error: lua script failed: [string "%transfiletriggerin(udev-254.9-2.1.x86_64)"]:4: exit code %transfiletriggerin(sdbootutil-1+git20240215.cb7e392-1.1.x86_64) script output: Error: No ESP detected. Legacy system? warning: %transfiletriggerin(sdbootutil-1+git20240215.cb7e392-1.1.x86_64) scriptlet failed, exit status 1 Running post-transaction scripts .........................................[done] Installation has completed with error. lkocman@tw:~> -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1214364] New: net-snmp: new release 5.9.4
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1214364 Bug ID: 1214364 Summary: net-snmp: new release 5.9.4 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: abergmann(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- https://github.com/net-snmp/net-snmp/blob/v5.9.4/CHANGES *5.9.4*: IMPORTANT: SNMP over TLS and/or DTLS are not functioning properly in this release with various versions of OpenSSL and will be fixed in a future release. libsnmp: - Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not used in the Net-SNMP code base. - DISPLAY-HINT fixes - Miscellanious improvements to the transports - Handle multiple oldEngineID configuration lines - fixes for DNS names longer than 63 characters agent: - Added a ignoremount configuration option for the HOST-MIB - disallow SETs with a NULL varbind - fix the --enable-minimalist build apps: - snmpset: allow SET with NULL varbind for testing - snmptrapd: improved MySQL logging code general: - configure: Remove -Wno-deprecated as it is no longer needed - miscellanious ther bug fixes, build fixes and cleanups -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1225063] New: [Firmware Bug]: CPU 0: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0010
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225063 Bug ID: 1225063 Summary: [Firmware Bug]: CPU 0: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0010 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jshand2013(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi guys, Since the last update of tumbleweed and the one before that i have noticed that plymouth didn't seem to switch to the normal screen showing the small circle that rotates. instead it gives you another screen with 3 little dots on the bottom and in some places question marks i'm wondering if these issues below could be the cause: [Firmware Bug]: CPU 0: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0010 [Firmware Bug]: CPU 1: APIC ID mismatch. CPUID: 0x0001 APIC: 0x0011 I have attached dmesg log for more information many thanks -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1220520] New: Configure remote printer: does not disable local cups entirely
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220520 Bug ID: 1220520 Summary: Configure remote printer: does not disable local cups entirely Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: All Status: NEW Severity: Minor Priority: P5 - None Component: Printing Assignee: jsmeix(a)suse.com Reporter: bnacht(a)web.de QA Contact: jsmeix(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Fresh installed Leap; Configure a remote printer; Get the message that the local cups will be disabled -> OK; But after that I get the message that the local cups is running again. It looks like YaST does only disable cups.service; cups.socket and cups.path, but not stop them (missing --now ?) After I stop the three units the config was successful. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1224364] New: btrfsmaintenance 0.5.1: openqa test failing at "btrfs scrub status"
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224364 Bug ID: 1224364 Summary: btrfsmaintenance 0.5.1: openqa test failing at "btrfs scrub status" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi, The SR#1172967 with the update to 0.5.1 fails when running: btrfs scrub status / | grep -e "Status:.*finished" openQA test in scenario opensuse-Staging:J-Staging-JeOS-for-kvm-and-xen-x86_64-jeos-filesystem@uefi-staging-virtio-2G fails in [btrfsmaintenance](https://openqa.opensuse.org/tests/4191091/modules/btrfsma… This is blocking the package to be accepted into Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1223413] New: [TRACKER] FTBFS due to boost 1.85
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1223413 Bug ID: 1223413 Summary: [TRACKER] FTBFS due to boost 1.85 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- A non exhaustive list of packages failing to build directly because boost 1.85: * hugin https://bugzilla.opensuse.org/show_bug.cgi?id=1223377 (FIXED) * rstudio https://bugzilla.opensuse.org/show_bug.cgi?id=1223378 * znc https://bugzilla.opensuse.org/show_bug.cgi?id=1223381 * lucene++ SR https://build.opensuse.org/request/show/1170262 * uhd * FreeCAD * wt * sfcgal -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1222156] New: After an upgrade the graphical interface no longer works
by bugzilla_noreply＠suse.com 09 Jul '24

09 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222156 Bug ID: 1222156 Summary: After an upgrade the graphical interface no longer works Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: rm.canella(a)gmail.com QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On my HP 255 G5 Notebook PC, following "zypper dup --no-allow-vendor-change" (openSUSE-20231218-0) the system no longer starts in graphics mode. - I did some checks and the problem seems to be on the "radeonsi_dri" driver; The following error message appears in the dmesg: [ 84.119680] gnome-shell[1557]: segfault at 40 ip 00007ff2ca32b98d sp 00007ffe59c27170 error 4 in radeonsi_dri.so[7ff2c9c91000+1476000] likely on CPU 1 (core 1, socket 0) - Doing an lspci the video card is: 00:01.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Mullins [Radeon R3 Graphics] (rev 40) - And the following is the output of the zypper info kernel-firmware-radeon command: Information for package kernel-firmware-radeon: ------------------------------------------------- Repository : Main Repository (OSS) Name : kernel-firmware-radeon Version: 20240322-1.1 Arch : noarch Vendor: openSUSE Installed Size: 3.3 MiB Installed : Yes (automatically) Status: up-to-date Source package : kernel-firmware-20240322-1.1.src Upstream URL: https://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/ Summary : Kernel firmware files for Radeon graphics driver Description: This package contains compressed kernel firmware files for Radeon graphics driver. -- You are receiving this mail because: You are on the CC list for the bug.

1 40

[Bug 1224536] New: Package dia does not build with gcc14 because of a call argument with an incompatible pointer type
by bugzilla_noreply＠suse.com 08 Jul '24

08 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224536 Bug ID: 1224536 Summary: Package dia does not build with gcc14 because of a call argument with an incompatible pointer type Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Gcc 14 newly by default treats as errors a number of situations which before were only warnings. For more information see https://gcc.gnu.org/gcc-14/porting_to.html and meta bug #1220571. Because of this, package fails to compile. This can be seen online at: https://build.opensuse.org/package/live_build_log/home:rguenther:plgrnd/dia… It can be reproduced locally with command: osc build --clean --alternative-project home:rguenther:nextgcc The error (that halts the build) is: [ 66s] custom_object.c: In function 'custom_setup_properties': [ 66s] custom_object.c:382:49: error: passing argument 1 of '(info->props + (sizetype)((long unsigned int)i * 88))->ops->get_data_size' from incompatible pointer type [-Wincompatible-pointer-types] [ 66s] 382 | size = info->props[i].ops->get_data_size (&info->props[i]); [ 66s] | ^~~~~~~~~~~~~~~ [ 66s] | | [ 66s] | PropDescription * {aka struct _PropDescription *} [ 66s] custom_object.c:382:49: note: expected 'Property *' {aka 'struct _Property *'} but argument is of type 'PropDescription *' {aka 'struct _PropDescription *'} -- You are receiving this mail because: You are on the CC list for the bug.

1 1