June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1222825] New: VUL-0: CVE-2024-28869: traefik: denial of service
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1222825 Bug ID: 1222825 Summary: VUL-0: CVE-2024-28869: traefik: denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401695/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28869 https://www.cve.org/CVERecord?id=CVE-2024-28869 https://doc.traefik.io/traefik/routing/entrypoints/#respondingtimeouts https://github.com/traefik/traefik/commit/240b83b77351dfd8cadb91c305b84e9d2… https://github.com/traefik/traefik/releases/tag/v2.11.2 https://github.com/traefik/traefik/releases/tag/v3.0.0-rc5 https://github.com/traefik/traefik/security/advisories/GHSA-4vwx-54mw-vqfw https://bugzilla.redhat.com/show_bug.cgi?id=2274987 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1224384] New: VUL-0: CVE-2024-4068: traefik: the npm package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS)
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224384 Bug ID: 1224384 Summary: VUL-0: CVE-2024-4068: traefik: the npm package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405384/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: gabriele.sonnu(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- The NPM package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4067 https://www.cve.org/CVERecord?id=CVE-2024-4067 https://devhub.checkmarx.com/cve-details/CVE-2024-4067/ https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0… https://github.com/micromatch/micromatch/issues/243 https://github.com/micromatch/micromatch/pull/247 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1221348] New: SELinux: relabeling after reboot is not communicated to user
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221348 Bug ID: 1221348 Summary: SELinux: relabeling after reboot is not communicated to user Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jsegitz(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: qa-bugs(a)suse.de CC: cathy.hu(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Hi, if the SELinux policy is updated and the system reboots, the system gets relabeled. But this is not communicated to the user, it just looks like the system is stuck during boot. Especially with MicroOS the user might not know what was part of the last update. If the system is stuck during boot some users might not know that they use SELinux and where the wait is coming from. From a usability point of view: would it be possible to print a message that the system is currently relabeling the filesystem and maybe also add a message that it is done ? Second part might not be strictly needed, but I think some messaging might be helpful for users. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226479] New: Wireless does not work after I installed broadcom-wl
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226479 Bug ID: 1226479 Summary: Wireless does not work after I installed broadcom-wl Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: HP OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: aweterings(a)proton.me QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0 Build Identifier: Before Aeon I used Micro OS Desktop and there I would perform these steps: Install, add packman repository, vendor change, install broadcom-wl and reboot. After that wireless would show up when clicking the icon bar top right in Gnome. When performing the exact same steps on Aeon RC2, wireless is not available. During installation no errors are displayed. Reproducible: Always Steps to Reproduce: 1. Install Aeon RC2 2. Perform sudo transactional-update dup 3. Reboot 4. Perform sudo transactional-update shell 5. sudo zypper dup 6. sudo zypper ar -cfp 90 'https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/' packman 7. sudo zypper dup --from packman --allow-vendor-change 8. sudo zypper install broadcom-wl 9. exit 10. systemctl reboot Actual Results: Wireless device is not working Expected Results: When clicking the top right bar of Gnome, I would select wireless and choose a wireless network. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1225522] New: sharing a folder in nautilus gives a usershare failed error
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225522 Bug ID: 1225522 Summary: sharing a folder in nautilus gives a usershare failed error Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Desktop Environment Assignee: rbrown(a)suse.com Reporter: hotel-brot.0z(a)icloud.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Build Identifier: sharing a folder in nautilus gives a usershare failed error: Called "net usershare info" but it failed: »net usershare« returned error 255: net usershare: usershares are currently disabled Reproducible: Always Steps to Reproduce: 1.create any folder for testing 2.right click on folder in nautilus -> Sharing Options -> Share this folder -> Create Share Actual Results: Called "net usershare info" but it failed: »net usershare« returned error 255: net usershare: usershares are currently disabled Expected Results: successful sharing of a folder journalctl does not show more than the same error given above -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1225546] New: Installation fails on nvme lba format 4096 bytes
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225546 Bug ID: 1225546 Summary: Installation fails on nvme lba format 4096 bytes Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Installation Assignee: rbrown(a)suse.com Reporter: jarkko.torvinen(a)iki.fi QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Build Identifier: Installer seems to go through fine, does not boot, drive seems empty without partitions. Same drive/machine with lba format 512 bytes works fine Reproducible: Always Steps to Reproduce: 1. get supported formats, nvme id-ns -H /dev/nvme0n1 2. format drive, nvme format --lbaf=1 /dev/nvme0n1 3. Run installer -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1225689] New: Error message received from tik with mount system call failed.
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225689 Bug ID: 1225689 Summary: Error message received from tik with mount system call failed. Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: rbrown(a)suse.com Reporter: tony.neely(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Build Identifier: [tik][20240531-02:01:04][LOG] [START] /usr/bin/tik [/usr/lib/tik/modules/pre/10-welcome][20240531-02:01:04][LOG] [START] /usr/lib/tik/modules/pre//usr/lib/tik/modules/pre/10-welcome [/usr/lib/tik/modules/pre/10-welcome][20240531-02:01:24][LOG] [zenity][0][] --info --ok-label=Install Now --no-wrap --width=300 --height=300 --icon=distributor-logo-Aeon-symbolic --title= --text=<big>Welcome to openSUSE Aeon</big>\n\nPlease press <b>Install Now</b> to continue [/usr/lib/tik/modules/pre/10-welcome][20240531-02:01:24][LOG] [STOP] /usr/lib/tik/modules/pre//usr/lib/tik/modules/pre/10-welcome [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:24][LOG] [START] /usr/lib/tik/modules/pre//usr/lib/tik/modules/pre/20-mig [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:32][LOG] [pkexec][0] /usr/bin/mkdir -p /var/lib/tik/mig [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:43][LOG] [zenity][0][nvme-Samsung_SSD_970_EVO_Plus_250GB_S4P3NF0M605653V] --list --column=Disk --column=Size --width=1000 --height=340 --title=Select A Disk --text=Select the disk to install the operating system to. <b>Make sure any important documents and files have been backed up.</b>\n ata-Samsung_SSD_860_EVO_1TB_S3Z8NY0M767057P 931.5G nvme-Samsung_SSD_970_EVO_Plus_250GB_S4P3NF0M605653V 232.9G [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:43][LOG] [pkexec][0] /usr/bin/mkdir -p /var/lib/tik/mig/mnt [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:43][LOG] [pkexec][0] /usr/bin/mount -o compress=zstd:1 /dev/disk/by-id/nvme-eui.0025385691b29275-part2 /var/lib/tik/mig/mnt [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:43][LOG] [probe_partitions] /dev/disk/by-id/nvme-eui.0025385691b29275-part2 found [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:43][LOG] Legacy Aeon Install FOUND [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:48][LOG] [pkexec][0] /usr/bin/umount /var/lib/tik/mig/mnt [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:48][LOG] [pkexec][0] /usr/bin/rmdir /var/lib/tik/mig/mnt [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:48][LOG] [pkexec][0] /usr/bin/mkdir /var/lib/tik/mig/mnt mount: /var/lib/tik/mig/mnt: mount system call failed: No such file or directory. dmesg(1) may have more information after failed mount system call. [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:48][LOG] [pkexec][32] /usr/bin/mount -o compress=zstd:1,subvol=/@/home /dev/disk/by-id/nvme-eui.0025385691b29275-part2 /var/lib/tik/mig/mnt [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:48][ERROR] Command <tt>/usr/bin/mount -o compress=zstd:1,subvol=/@/home /dev/disk/by-id/nvme-eui.0025385691b29275-part2 /var/lib/tik/mig/mnt</tt> FAILED [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:54][LOG] [zenity][0][] --error --text Command <tt>/usr/bin/mount -o compress=zstd:1,subvol=/@/home /dev/disk/by-id/nvme-eui.0025385691b29275-part2 /var/lib/tik/mig/mnt</tt> FAILED [/usr/lib/tik/modules/pre/20-mig][20240531-02:01:54][LOG] [STOP][1] /usr/bin/tik Reproducible: Always Actual Results: System notified me of error and shut down. I have an existing Aeon install, with a separate drive (BTRFS formatted) for my /home. Easy enough to setup with old installer. Chose system drive (not /home drive) for the install. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1226979] New: New Installer - Root Encryption/Lunks
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226979 Bug ID: 1226979 Summary: New Installer - Root Encryption/Lunks Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: MicroOS Assignee: forgotten_u0-bnvADNc(a)user.net Reporter: regis(a)hubelia.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Build Identifier: There aren't any easy way to encrypt the root disk. For organisations with compliance, this is not viable. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1226109] New: Aeon installation failed with the newer installer
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226109 Bug ID: 1226109 Summary: Aeon installation failed with the newer installer Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Critical Priority: P5 - None Component: Installation Assignee: rbrown(a)suse.com Reporter: StellarTerror2(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Build Identifier: i was prompted with a Command /usr/bin/cat /var/ lib/tik/mig/passwd.out FAILED please refer to the attached tik.log file Reproducible: Always Steps to Reproduce: 1.Write the image on a USB 2.Boot into it 3.It shows the installion failure system is shutting down warning Actual Results: I was prompted for a system shutdown Expected Results: I should've been able to install properly -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1226433] New: aeon-firstboot only shows on waiting for internet connection
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226433 Bug ID: 1226433 Summary: aeon-firstboot only shows on waiting for internet connection Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: rbrown(a)suse.com Reporter: max.schumacher(a)mail.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0 Build Identifier: After installing aeon and selecting flatpaks to install via the firstboot application, the installer stays on "waiting for internet connection". While no progress is visible the flatpaks are being installed in the background as they appear one by one in the menu. After the installation of all flatpaks the firstboot-installer congratulates me and says aeon is ready to use. I could reproduce this every time in KVM, thinking it was a virtualisation related bug. Today I installed aeon on my hardware and had this happen again. Reproducible: Always Steps to Reproduce: 1. Install aeon 2. Install customized or default flatpak selection Actual Results: Flatpaks install in the background while installer shows "waiting for internet connection". Expected Results: A progress of currently installing flatpaks. I'm connected to my router via ethernet and to internet via dualstack (IPv4&IPv6). I followed the install guide on the website with a freshly downloaded .raw.xz -- You are receiving this mail because: You are on the CC list for the bug.

1 3