June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225875] New: VUL-0: CVE-2024-36127: apko: exposure of HTTP basic auth credentials in log output
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1225875 Bug ID: 1225875 Summary: VUL-0: CVE-2024-36127: apko: exposure of HTTP basic auth credentials in log output Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408521/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: opensuse_buildservice(a)ojkastl.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36127 https://www.cve.org/CVERecord?id=CVE-2024-36127 https://github.com/chainguard-dev/apko/commit/2c0533e4d52e83031a04f6a83ec63… https://github.com/chainguard-dev/apko/security/advisories/GHSA-v6mg-7f7p-q… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226058] New: VUL-0: CVE-2024-37150: deno: private npm registry support used scope auth token for downloading tarballs
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1226058 Bug ID: 1226058 Summary: VUL-0: CVE-2024-37150: deno: private npm registry support used scope auth token for downloading tarballs Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408913/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: aavindraa(a)gmail.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-37150 https://www.cve.org/CVERecord?id=CVE-2024-37150 https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2a… https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-sc… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1226223] New: VUL-0: CVE-2024-22423: yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1226223 Bug ID: 1226223 Summary: VUL-0: CVE-2024-22423: yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401050/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead. References: https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973… https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11 https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22423 https://www.cve.org/CVERecord?id=CVE-2024-22423 https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a3… https://github.com/yt-dlp/yt-dlp/releases/tag/2024.04.09 https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p https://bugzilla.redhat.com/show_bug.cgi?id=2270691 https://www.kb.cert.org/vuls/id/123335 https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-comma… https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalik… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215701] New: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1215701 Bug ID: 1215701 Summary: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/379815/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: rfrohl(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40581 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1226375] New: VUL-0: CVE-2024-37884: nextcloud: users can delete old versions of read-only shared files
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1226375 Bug ID: 1226375 Summary: VUL-0: CVE-2024-37884: nextcloud: users can delete old versions of read-only shared files Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410998/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3. References: https://github.com/nextcloud/server/pull/43727 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-37884 https://www.cve.org/CVERecord?id=CVE-2024-37884 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://hackerone.com/reports/2290680 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1222859] New: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1222859 Bug ID: 1222859 Summary: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401694/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mia(a)0x0.st Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32019 https://www.cve.org/CVERecord?id=CVE-2024-32019 https://github.com/netdata/netdata/pull/17377 https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93 https://bugzilla.redhat.com/show_bug.cgi?id=2274984 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214211] New: "Loading basic drivers" is printed twice on the screen when loading installation system
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1214211 Bug ID: 1214211 Summary: "Loading basic drivers" is printed twice on the screen when loading installation system Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: dheidler(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 868778 --> https://bugzilla.suse.com/attachment.cgi?id=868778&action=edit screenshot Something like this is printed: Loading basic drivers...Loading basic drivers ok Expected: Loading basic drivers... ok -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1227070] New: gettext.sh missing dependency on envsubst
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227070 Bug ID: 1227070 Summary: gettext.sh missing dependency on envsubst Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: pafee(a)tycoint.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Using "git submodule status", I see unexpected error text alongside the expected output. $ git submodule status /usr/bin/gettext.sh: line 88: envsubst: command not found /usr/bin/gettext.sh: line 88: envsubst: command not found <expected output follows> Within gettext.sh, line 88 invokes envsubst. This used to be provided by the gettext-runtime package, however has split out into a separate envsubst package (built from the same source RPM as as gettext-runtime. Should the gettext-runtime binary RPM have a "requires" dependency on envsubst? -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1221918] New: VUL-0: CVE-2024-2824: jhead: heap-based buffer overflow in function PrintFormatNumber
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1221918 Bug ID: 1221918 Summary: VUL-0: CVE-2024-2824: jhead: heap-based buffer overflow in function PrintFormatNumber Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/398716/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: pgajdos(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- A vulnerability was found in Matthias-Wandel jhead 3.08 and classified as critical. This issue affects the function PrintFormatNumber of the file exif.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257711. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2824 https://www.cve.org/CVERecord?id=CVE-2024-2824 https://github.com/Matthias-Wandel/jhead/files/14613084/poc.zip https://github.com/Matthias-Wandel/jhead/issues/84 https://vuldb.com/?ctiid.257711 https://vuldb.com/?id.257711 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1223446] New: zypper dup uninstalls > 100 base packages (guess: because of unknown repo signing key)
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223446 Bug ID: 1223446 Summary: zypper dup uninstalls > 100 base packages (guess: because of unknown repo signing key) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)suse.de Reporter: suse-beta(a)cboltz.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874527 --> https://bugzilla.suse.com/attachment.cgi?id=874527&action=edit y2logs.tar.xz Environment: a s390x (zSystems) VM on the LinuxOne community cloud (https://linuxone.cloud.marist.edu) originally SLE 15 SP4, upgraded to Tumbleweed. To automate the Tumbleweed updates, I enabled os-update, which basically calls zypper dup -y --auto-agree-with-product-licenses This automated update worked on 2024-04-04. For some (so far unknown) reason, the automated zypper dup on 2024-04-26 uninstalled lots of packages, including quite some base packages (for example sudo, less, vim, file, shadow), and left the system in a half-broken state. At least ssh login and su still worked. After re-creating /etc/resolv.conf and reinstalling the removed packages, I could get some logs and fix the system. (I had a similar breakage on another VM some months ago, but back then, I didn't know the root password and therefore couldn't collect logs.) An interesting detail is that zypper asked me to trust a key today: # zypper ref Repository 'repo-openh264 (%{distver})' is up to date. New repository or package signing key received: Repository: repo-oss (%{distver}) Key Fingerprint: F00C 20EF 1E11 14C9 B5F6 9B22 76CA 4244 F6AB 3975 Key Name: openSUSE:Factory:zSystems OBS Project <openSUSE:Factory:zSystems@build.opensuse.org> Key Algorithm: RSA 2048 Key Created: Tue 02 Aug 2022 11:09:47 PM EDT Key Expires: Thu 10 Oct 2024 11:09:47 PM EDT Rpm Name: gpg-pubkey-f6ab3975-62e9e6fb That might already be a hint what caused the removal of the packages. If I zypper mr -d openSUSE:repo-oss zypper dup it proposes to delete 108 packages - and on a quick look, the list looks similar to what was removed automagically. My _guess_ is that the missing key had a similar result as disabling the repo. Still, even "zypper dup -y" should error out if a repo is signed with an unknown key, instead of silently disabling the repo and removing seemingly "orphaned" packages. I'll attach the y2logs so that you can check if my guess is correct ;-) -- You are receiving this mail because: You are on the CC list for the bug.

1 2