May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224860] recent wicked change related to STARTMODE?
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224860 https://bugzilla.suse.com/show_bug.cgi?id=1224860#c7 --- Comment #7 from Patrick Schaaf <patrick.schaaf(a)yalwa.com> --- (In reply to Marius Tomaschewski from comment #6) > == dummy0 is manual and skipped + vlan10 requires it -> skip both If that is the intended behaviour (and recent change was just about actually making it so, previously it only accidentally brought both up) - then fine with me + I will adapt my ways! (no need from my pov for you to try and recreate my more complicated setup) Thank you again for the answers, they give me the direction I need. I'd be happy for the ticket to be closed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224470] Broken dependency for python311-psycopg-3.1.18-1.2.noarch
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224470 https://bugzilla.suse.com/show_bug.cgi?id=1224470#c2 Daniel Garcia <daniel.garcia(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #2 from Daniel Garcia <daniel.garcia(a)suse.com> --- This is fixed now. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224818] New: VUL-0: chromium: multiple vulnerabilities fixed in 125.0.6422.76
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224818 Bug ID: 1224818 Summary: VUL-0: chromium: multiple vulnerabilities fixed in 125.0.6422.76 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger(a)gmx.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: gmbr3(a)opensuse.org Target Milestone: --- Found By: --- Blocker: --- Fixed in chromium 125.0.6422.76: * CVE-2024-5157: Use after free in Scheduling. * CVE-2024-5158: Type Confusion in V8 * CVE-2024-5159: Heap buffer overflow in ANGLE * CVE-2024-5160: Heap buffer overflow in Dawn * Various fixes from internal audits, fuzzing and other initiatives https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-des… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1225024] New: VUL-0: CVE-2024-35197: gitoxide: refs and paths with reserved Windows device names access the devices
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225024 Bug ID: 1225024 Summary: VUL-0: CVE-2024-35197: gitoxide: refs and paths with reserved Windows device names access the devices Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. References: https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35197 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1225023] New: VUL-0: CVE-2024-35186: gitoxide: traversal outside working tree enables arbitrary code execution
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225023 Bug ID: 1225023 Summary: VUL-0: CVE-2024-35186: gitoxide: traversal outside working tree enables arbitrary code execution Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. References: https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35186 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1222922] [UDISKS2 BUG] Error getting loopX information after boot
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222922 https://bugzilla.suse.com/show_bug.cgi?id=1222922#c1 Thomas Blume <thomas.blume(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Thomas Blume <thomas.blume(a)suse.com> --- (In reply to Egor Kuznetsov from comment #0) > Possible fix: appstream Udisks released version 2.10.1 with fix. Fix is: > https://github.com/storaged-project/udisks/pull/1148 > It need libblockdev commit, but as I see, libblockdev commit has been > included in the code for a long time ago. So, can we update udisks, if its > possible? Thanks for the report. An update to udisks version 2.10.1 has been submitted. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224860] recent wicked change related to STARTMODE?
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224860 https://bugzilla.suse.com/show_bug.cgi?id=1224860#c6 --- Comment #6 from Marius Tomaschewski <mt(a)suse.com> --- Let's try it out -- with a simple config first: epyc1:/etc/sysconfig/network # cat ifcfg-dummy0 STARTMODE=manual epyc1:/etc/sysconfig/network # cat ifcfg-vlan10 STARMODE=auto ETHERDEVICE=dummy0 VLAN_ID=10 epyc1:/etc/sysconfig/network # wicked ifup --dry-run all […] wicked: Config interface hierarchy structure: wicked: + lo [1] wicked: vlan10 wicked: +-- dummy0 wicked: dummy0 == dummy0 is manual and skipped + vlan10 requires it -> skip both epyc1:/etc/sysconfig/network # wicked ifup --dry-run dummy0 […] wicked: lo [1] wicked: vlan10 wicked: + +-- dummy0 wicked: + dummy0 == dummy0 requested manually -> start it, but not it's vlan interface on top epyc1:/etc/sysconfig/network # wicked ifup --dry-run vlan10 […] wicked: lo [1] wicked: + vlan10 wicked: + +-- dummy0 wicked: + dummy0 == vlan10 requested manually + requires dummy0 with STARTMODE=manual, but because this is a manual / explicit request, STARTMODE=manual is not excluded -> both are started Going to make the same with your config (but bond0 as bridge port and using 2 interfaces in comment #0 with ifcfg-lacp)... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224860] recent wicked change related to STARTMODE?
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224860 https://bugzilla.suse.com/show_bug.cgi?id=1224860#c5 --- Comment #5 from Marius Tomaschewski <mt(a)suse.com> --- (In reply to Patrick Schaaf from comment #3) > (In reply to Marius Tomaschewski from comment #1) > > Thank you for looking into this, and all the explanation. What you write, > matches my understanding / expectation. Note that I do not use STARTMODE=off > but (on the "underlings") STARTMODE=manual. Yes. While STARTMODE=off disables an interface in any ifup, STARTMODE=manual disables to start it in the "wicked ifup all" call (made by network.service) at boot aka needs manual "wicked ifup <name1>" call. See also ifcfg(5) man page: ``` STARTMODE {manual*|auto|nfsroot|hotplug|off} Choose when the interface should be set up. manual Interface will be set up if ifup is called manually auto Interface will be set up as soon as it is available (and service net- work was started). This either happens at boot time when network is starting or via hotplug when a interface is added to the system (by adding a device or loading a driver). To be backward compliant onboot, on and boot are aliases for auto. hotplug Interface will be activated when it is available. Use instead of auto for devices which may be missed, such as bonding slaves, usb or other plugable hardware. nfsroot Nearly like auto, but interfaces with this startmode will be not shut down by default. Use this mode when you use a root filesystem via network or want to avoid interface shutdown. To force a nfsroot inter- face down, use either wicked ifdown --force device-down <interface> or ifdown <interface> -o force. off Will never be activated. ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224818] VUL-0: chromium: multiple vulnerabilities fixed in 125.0.6422.76
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224818 https://bugzilla.suse.com/show_bug.cgi?id=1224818#c2 --- Comment #2 from Marcus Meissner <meissner(a)suse.com> --- openSUSE-SU-2024:0137-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1224818 CVE References: CVE-2024-5157,CVE-2024-5158,CVE-2024-5159,CVE-2024-5160 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): chromium-125.0.6422.76-bp155.2.85.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223978] Package 4store does not build with gcc14 because of implicit function declarations
by bugzilla_noreply＠suse.com 23 May '24

23 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223978 https://bugzilla.suse.com/show_bug.cgi?id=1223978#c3 Martin Jambor <mjambor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #3 from Martin Jambor <mjambor(a)suse.com> --- This has been fixed also in Factory with https://build.opensuse.org/request/show/1172392 (or so I think). -- You are receiving this mail because: You are on the CC list for the bug.

1 0