June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c10 --- Comment #10 from David Anes <david.anes(a)suse.com> --- (In reply to Dirk Stoecker from comment #9) > For completeness the nochunk test: > > #!/usr/bin/perl > > print "Status: 200 OK\r\n"; > print "Content-Length: 3\r\n"; > print "\r\n"; > print "---"; > > Error: > < HTTP/1.1 200 OK > < Date: Thu, 13 Jun 2024 09:06:58 GMT > < Server: Apache > < Transfer-Encoding: chunked > < Content-Type: application/x-cgi > > Ok: > < HTTP/1.1 200 OK > < Date: Thu, 13 Jun 2024 09:07:48 GMT > < Server: Apache > < Content-Length: 3 > < Content-Type: application/x-cgi Ok, I see. Let me investigate, thank you. I will come back to you asap. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c9 --- Comment #9 from Dirk Stoecker <opensuse(a)dstoecker.de> --- For completeness the nochunk test: #!/usr/bin/perl print "Status: 200 OK\r\n"; print "Content-Length: 3\r\n"; print "\r\n"; print "---"; Error: < HTTP/1.1 200 OK < Date: Thu, 13 Jun 2024 09:06:58 GMT < Server: Apache < Transfer-Encoding: chunked < Content-Type: application/x-cgi Ok: < HTTP/1.1 200 OK < Date: Thu, 13 Jun 2024 09:07:48 GMT < Server: Apache < Content-Length: 3 < Content-Type: application/x-cgi -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224059] New: Bumblebee freezes laptop at boot
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1224059 Bug ID: 1224059 Summary: Bumblebee freezes laptop at boot Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: aleksey.rukhlenko(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I found two ways to reproduce this bug. 1. Only suse-prime and bbswitch are installed. In this case, you need to switch to nvidia drivers, logout, login, then switch to intel, logout, and then the system freezes. After forced switch off and on, the booting process freezes at the starting of X server. 2. bbswitch, bumblebee and primusrun are installed, bumblebee daemon is configured to start on boot, the user is added to bumblebee and video groups. In this case, system freezes on boot during starting X server. In addition, the very presence of bbswitch and suse-prime installed screws up the laptop sound, even if intel drivers are chosen and system does not freeze. Hardware: Dell XPS 17 9700 OS: Fresh install of OpenSUSE 15.6 64-bit. Nvidia drivers: nvidia-G06 Kind regards, Oleksii -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c8 --- Comment #8 from David Anes <david.anes(a)suse.com> --- (In reply to Dirk Stoecker from comment #7) > Here a short test script showing both issues: > > #!/usr/bin/perl > > print "Status: 200 OK\r\n"; > print "Transfer-Encoding: chunked\r\n"; > print "Content-Length: 3\r\n"; > print "\r\n"; > print "3\r\n"; > print "---\r\n"; > print "0\r\n"; > print "\r\n"; Isn't this wrong as per http spec? > 3. If a message is received with both a Transfer-Encoding and a Content-Length header field, the Transfer-Encoding overrides the Content-Length. Such a message might indicate an attempt to perform request smuggling (Section 11.2) or response splitting (Section 11.1) and ought to be handled as an error. An intermediary that chooses to forward the message MUST first remove the received Content-Length field and process the Transfer-Encoding (as described below) prior to forwarding the message downstream. https://www.rfc-editor.org/rfc/rfc9112#name-message-body-length The problem I see is that our patches are missing a patch that was added later to show an error instead of processing the request (https://github.com/apache/httpd/pull/444) Can you try the same but removing "Transfer-Encoding" from the perl CGI? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c7 --- Comment #7 from Dirk Stoecker <opensuse(a)dstoecker.de> --- Here a short test script showing both issues: #!/usr/bin/perl print "Status: 200 OK\r\n"; print "Transfer-Encoding: chunked\r\n"; print "Content-Length: 3\r\n"; print "\r\n"; print "3\r\n"; print "---\r\n"; print "0\r\n"; print "\r\n"; Error (curl -vv, stripped private info) > GET /cgi-bin/error.cgi HTTP/1.1 > User-Agent: curl/8.8.0 > Accept: */* > * Request completely sent off < HTTP/1.1 200 OK < Date: Thu, 13 Jun 2024 08:53:37 GMT < Server: Apache < Transfer-Encoding: chunked < Content-Type: application/x-cgi < 3 --- 0 --- in tcpdump the double encoding is visible better: MHTTP/1.1 200 OK Date: Thu, 13 Jun 2024 08:45:23 GMT Server: Apache Transfer-Encoding: chunked Content-Type: application/x-cgi 8 3 --- 0 Ok: > GET /cgi-bin/error.cgi HTTP/1.1 > User-Agent: curl/8.8.0 > Accept: */* > * Request completely sent off < HTTP/1.1 200 OK < Date: Thu, 13 Jun 2024 08:54:09 GMT < Server: Apache < Transfer-Encoding: chunked < Content-Length: 3 < Content-Type: application/x-cgi < * Connection #0 to host a07upload.gnssonline.eu left intact --- It SHOULD send content length header and not do transfer encoding different to the script (i.e. when script has no transfer encoding, the output also shouldn't - not tested in this example). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c6 --- Comment #6 from David Anes <david.anes(a)suse.com> --- (In reply to Dirk Stoecker from comment #0) > User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 > Firefox/126.0 > Build Identifier: > > A CGI script sents > Status: 200 OK\r\n > Content-Length: 422264\r\n > Content-type: application/octet-stream\r\n > Connection: close\r\n\rn > ...data > > the Apache sends > HTTP/1.1 200 OK\r\n > Date: Wed, 12 Jun 2024 11:24:45 GMT\r\n > Server: Apache\r\n > Connection: close\r\n > Transfer-Encoding: chunked\r\n > Content-Type: application/octet-stream\r\n\r\n > > This is missing the content length. This again breaks the client software > relying on the content length. > Dirk, to speed up things while I setup everything, can you send us the same information (a sample for headers in/out of the http requests) using the downgraded version that works for you? Thank you. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226164] Error: Command /usr/bin/rmdir /var/lib/tik/mig/mnt FAILED
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226164 https://bugzilla.suse.com/show_bug.cgi?id=1226164#c2 Richard Brown <rbrown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED CC| |rbrown(a)suse.com --- Comment #2 from Richard Brown <rbrown(a)suse.com> --- released in 0611 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225882] Upgrade from Luks Opensuse MicroOS Desktop Fails
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1225882 https://bugzilla.suse.com/show_bug.cgi?id=1225882#c19 Richard Brown <rbrown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #19 from Richard Brown <rbrown(a)suse.com> --- released in 0611 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226120] Tik Installer fails to unmount mounted encrypted drive
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226120 https://bugzilla.suse.com/show_bug.cgi?id=1226120#c6 Richard Brown <rbrown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #6 from Richard Brown <rbrown(a)suse.com> --- released in 0611 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226221] Nautilus not starting: timeout on Connecting to org.freedesktop.Tracker3.Miner.Files
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226221 https://bugzilla.suse.com/show_bug.cgi?id=1226221#c3 Yifan Jiang <yfjiang(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gnome-bugs(a)suse.de |alynx.zhou(a)suse.com CC| |gnome-bugs(a)suse.de --- Comment #3 from Yifan Jiang <yfjiang(a)suse.com> --- I remember Alynx dealt with a similar issue (already fixed) before, so he would probably be able to double check. -- You are receiving this mail because: You are on the CC list for the bug.

1 0