June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225407] New: GNU tar hangs when extracting certain symlinks
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225407 Bug ID: 1225407 Summary: GNU tar hangs when extracting certain symlinks Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: psychonaut(a)nothingisreal.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The version of GNU tar 1.35 packaged for openSUSE Tumbleweed hangs when using --wildcards to extract a symlink to another file in the archive that does not match the wildcard. The problem may be specific to the openSUSE RPMs; I cannot reproduce it when using GNU tar 1.35 compiled from source. An example of an archive that can reproduce this problem is at <http://files.nothingisreal.com/tmp/news002f1.tar.bz2>. Using the command line tar xavf news002f1.tar.bz2 the archive is successfully extracted. But if I add a --wildcards option such as tar xavf news002f1.tar.bz2 --wildcards '*trek*' then tar hangs when it gets to the file news002f1/b5/net.startrek/24. This file, which matches the wildcard, is a symlink to the file news002f1/b5/net.sf-lovers/141, which does not match the wildcard. Running tar with strace shows that tar gets stuck in a loop: mkdirat(AT_FDCWD, "news002f1", 0755) = -1 EEXIST (File exists) mkdirat(AT_FDCWD, "news002f1/b5", 0755) = -1 EEXIST (File exists) mkdirat(AT_FDCWD, "news002f1/b5/net.startrek", 0755) = -1 EEXIST (File exists) newfstatat(AT_FDCWD, "news002f1/b5/net.startrek", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0 linkat(AT_FDCWD, "news002f1/b5/net.sf-lovers/141", AT_FDCWD, "news002f1/b5/net.startrek/24", 0) = -1 ENOENT (No such file or directory) newfstatat(AT_FDCWD, "news002f1/b5/net.sf-lovers/141", 0x7fffcaca26a0, AT_SYMLINK_NOFOLLOW) = -1 ENOENT (No such file or directory) By contrast, GNU tar 1.35 compiled from source does not hang; it instead emits the error messages of the following sort for the affected symlinks and then continues processing the archive: Cannot hard link to ‘news002f1/b5/net.sf-lovers/141’: No such file or directory -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1226850] New: Useradd doesn't create a group under the same name despite not using the -N flag
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226850 Bug ID: 1226850 Summary: Useradd doesn't create a group under the same name despite not using the -N flag Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: alice.brooks(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- So I've downloaded the latest Tumbleweed image (20240621) and ran it inside a vm, however any user that's created is no longer created with a matching named group, this includes ones from the initial installer and any new ones created via useradd You can recreate this either by running through the installer as mentioned above, or something like below: ``` sudo useradd -m test cat /etc/group | grep test ``` Prints out nothing, as the group test was never created -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1217967] New: grub2: verification build issue
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1217967 Bug ID: 1217967 Summary: grub2: verification build issue Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: jlee(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mchang(a)suse.com Target Milestone: --- Found By: --- Blocker: --- While working on reproducible builds for ALP + openSUSE, I found that our grub2 package produced different results when built locally compared to the official Factory build on OBS. My guess is that it comes from https://github.com/openSUSE/pesign-obs-integration filterdiff 'rpm -qp --qf %{PLATFORM}\n' binaries*/grub2-2.12~rc1-12.1.x86_64.rpm --- rpm -qp --qf %{PLATFORM}\n binaries/grub2-2.12~rc1-12.1.x86_64.rpm +++ rpm -qp --qf %{PLATFORM}\n binaries.nachbau/grub2-2.12~rc1-12.1.x86_64.rpm @@ -1 +1 @@ -x86_64-suse-linux +i386-suse-linux-gnu using https://github.com/bmwiedemann/reproducibleopensuse/blob/master/filterdiff Apart from that, there is the (probably unavoidable) sig itself: --- old /usr/share/grub2/x86_64-efi/grub.efi (hex) +++ new /usr/share/grub2/x86_64-efi/grub.efi (hex) @@ -1,6 +1,6 @@ 00000100 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| -00000120 00 00 00 00 00 00 00 00 00 50 1f 00 70 07 00 00 |.........P..p...| +* 00000130 00 30 1f 00 00 20 00 00 00 00 00 00 00 00 00 00 |.0... ..........| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1213659] New: VUL-0: CVE-2023-38496: apptainer: Ineffective privileges drop when requesting container network
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1213659 Bug ID: 1213659 Summary: VUL-0: CVE-2023-38496: apptainer: Ineffective privileges drop when requesting container network Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/373431/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: cgoll(a)suse.com Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38496 https://bugzilla.redhat.com/show_bug.cgi?id=2226582 https://www.cve.org/CVERecord?id=CVE-2023-38496 http://www.cvedetails.com/cve/CVE-2023-38496/ https://github.com/apptainer/apptainer/pull/1523 https://github.com/apptainer/apptainer/pull/1578 https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-w… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1224161] New: firefox menus invisible if fractional scaling enabled
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1224161 Bug ID: 1224161 Summary: firefox menus invisible if fractional scaling enabled Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: dpbasti(a)wp.pl QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874831 --> https://bugzilla.suse.com/attachment.cgi?id=874831&action=edit no-scaling-ok When I run 100% scale of my 4k monitor all is fine, changigng to 150% makes extension menus to become invisible. Screenshots attached. Not sure if it is related to firefox, nvidia , wayland or plasma6 plasma 6.0.5 with nvidia prime offload and wayland current tumbleweed -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1227194] New: ‘mount -t cifs’ then ‘ls /mnt’ causes “soft lockup - CPU#0 stuck”. Can’t kill -9 nor init s, etc
by bugzilla_noreply＠suse.com 21 Jul '24

21 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227194 Bug ID: 1227194 Summary: ‘mount -t cifs’ then ‘ls /mnt’ causes “soft lockup - CPU#0 stuck”. Can’t kill -9 nor init s, etc Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: hattons(a)speakeasy.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Build Identifier: Every time I do: USS-Liberty:~ # mount -t cifs //192.168.99.78/elements -o username=hattons /mnt/elements Password for hattons(a)//192.168.99.78/elements: followed by ‘ls /mnt’, I get 2024-06-27T03:48:38.093101-04:00 USS-Liberty kernel: [ 2664.161932][ C0] watchdog: BUG: soft lockup - CPU#0 stuck for 1643s! [ls:5764] etc. I can’t ‘kill -9 5764’, ‘reboot’, ‘halt’, ‘init s’, etc. Other CPUs start to get stuck on other processes. I haven’t been using Linux for several years, but in the good old days, this wasn’t supposed to happen. Reproducible: Always Steps to Reproduce: 1. # mount -t cifs //192.168.99.78/<share> -o username=<user> /mnt/<mount point> 2. ‘ls /mnt’ 3. Actual Results: I get repeated messages of the form 2024-06-27T03:48:38.093101-04:00 USS-Liberty kernel: [ 2664.161932][ C0] watchdog: BUG: soft lockup - CPU#0 stuck for 1643s! [ls:5764] I can’t ‘kill -9 5764’, ‘reboot’, ‘halt’, ‘init s’, etc. Other CPUs start to get stuck on other processes. Expected Results: Expected the remote share to either be mounted an ls to show me the contents of /mnt, or receive an error indicating a failure of the mount and/or ls commands. This is very deterministic. I have nothing to compare it to because it is my first Linux install in years, and I don't have a second machine to test with. There is, however, this: https://forums.opensuse.org/t/mount-t-cifs-then-ls-mnt-causes-soft-lockup-c… Unfortunately, I did a reinstall since I last crashed the machine, so I don't have logs. If you can't reproduce the result, I will try again. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1226207] New: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light
by bugzilla_noreply＠suse.com 21 Jul '24

21 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226207 Bug ID: 1226207 Summary: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- kf6-breeze-icons generate identical icons for both breeze & breeze-dark. While this is not an issue for KF6 apps, that use run-time recoloring, in KF5 apps, like Krusader, when dark color theme is used and icons are breeze-dark symbolic icons are dark on dark background and almost invisible. The reason is this build option: `-DWITH_ICON_GENERATION:BOOL=FALSE` I've tried to make my custom build [1] switching it to TRUE and breeze-dark icons are fine with Krusader now. But I don't know the reasoning behind switching it to FALSE. There is comment: ``` saves ~30MB and installs dangling symlinks ``` Less size is true, though IMHO it's not a good solution to break KF5 apps to save some space. But I can't see any dangling symlinks: ``` find /usr/share/icons/breeze{,-dark} -xtype l ``` doesn't find anything. Any other reason or should I cleanup [1] and make a submit request? [1] https://build.opensuse.org/package/show/home:NickLion:branches:KDE:Framewor… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1218581] New: Version of mesa and mesa-drivers different
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1218581 Bug ID: 1218581 Summary: Version of mesa and mesa-drivers different Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: ecsos(a)schirra.net QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Version of mesa and mesa-drivers different. This means that not a single package can be built in the build service that mesa requires. Message in OBS: The build can not begin, because required packages are either missing or not explicitly defined. Build jobs exist for the repository unresolvable: nothing provides Mesa = 22.3.5 needed by Mesa-dri, (got version 23.3.2-lp156.1520.1) -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1218387] New: VUL-0: CVE-2023-51766: exim: SMTP smuggling attack
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1218387 Bug ID: 1218387 Summary: VUL-0: CVE-2023-51766: exim: SMTP smuggling attack Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/389285/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: poeml(a)cmdline.net Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: meissner(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Exim server, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51766 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223459] New: akregator window cannot be restored from miniature box after login
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1223459 Bug ID: 1223459 Summary: akregator window cannot be restored from miniature box after login Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: benoit.monin(a)gmx.fr QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When akregator is started automatically during login, its main window cannot be restored by clicking on its icon in the miniature box. I created a new user for the test. Here are the steps to reproduce the problem: * Login * Start akregator and close its main window * Confirm that it can be reopened by left-clicking on its icon in the miniature box * Confirm that the "restore" option is available by right-clicking on it (see https://paste.opensuse.org/pastes/7e8061571f27) * Logout and log back in * Akregator is auto-started * Akregator icon is present in the miniature box but legt-clicking does nothing * Right-clicking shows a menu with the "restore" option missing (see https://paste.opensuse.org/pastes/9de44d025751) The work-around is to select quit from the menu then start akregator. It will behave correctly for the current session, until the next login. -- You are receiving this mail because: You are on the CC list for the bug.

1 1