June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224781] New: VUL-0: CVE-2024-35192: trivy: credential leak via malicious registry
by bugzilla_noreply＠suse.com 20 Feb '25

20 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1224781 Bug ID: 1224781 Summary: VUL-0: CVE-2024-35192: trivy: credential leak via malicious registry Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/406773/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35192 https://www.cve.org/CVERecord?id=CVE-2024-35192 https://github.com/aquasecurity/trivy/commit/e7f14f729de259551203f313e57d2d… https://github.com/aquasecurity/trivy/security/advisories/GHSA-xcq4-m2r3-cm… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1223925] New: VUL-0: CVE-2024-34508: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
by bugzilla_noreply＠suse.com 20 Feb '25

20 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1223925 Bug ID: 1223925 Summary: VUL-0: CVE-2024-34508: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/404391/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: kde-maintainers(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: gianluca.gabrielli(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34508 https://www.cve.org/CVERecord?id=CVE-2024-34508 https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca0… https://support.dcmtk.org/redmine/issues/1114 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223943] New: VUL-0: CVE-2024-34509: dcmtk: segmentation fault via an invalid DIMSE message
by bugzilla_noreply＠suse.com 20 Feb '25

20 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1223943 Bug ID: 1223943 Summary: VUL-0: CVE-2024-34509: dcmtk: segmentation fault via an invalid DIMSE message Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/404392/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: kde-maintainers(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. References: https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca0… https://support.dcmtk.org/redmine/issues/1114 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34509 https://www.cve.org/CVERecord?id=CVE-2024-34509 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1219070] New: Chromium won't play youtube videos
by bugzilla_noreply＠suse.com 18 Feb '25

18 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1219070 Bug ID: 1219070 Summary: Chromium won't play youtube videos Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: aloisio(a)gmx.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since the last two updates, using plasma/wayland, playing won't start and a generic error is shown. The console prints: ERROR:gl_surface_presentation_helper.cc(260)] GetVSyncParametersIfAvailable() failed for 1 times! Last functioning version is 119.0.6045.199-bp155.2.61.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 17 Feb '25

17 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1212956] New: Linphone 5.0.16 fails to launch. Symbol lookup error
by bugzilla_noreply＠suse.com 17 Feb '25

17 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1212956 Bug ID: 1212956 Summary: Linphone 5.0.16 fails to launch. Symbol lookup error Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: lair.retention968(a)4wrd.cc QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When launching Linphone, the following symbol lookup error message is shown: linphone: symbol lookup error: /lib64/liblinphone.so.10: undefined symbol: _ZN4lime11LimeManager6updateERKSt8functionIFvNS_14CallbackReturnENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEE linphone - 5.0.16-1.3 liblime - 5.2.73-1.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1221224] New: java-21-openjdk build-time race
by bugzilla_noreply＠suse.com 15 Feb '25

15 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1221224 Bug ID: 1221224 Summary: java-21-openjdk build-time race Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: fstrba(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1102408 Target Milestone: --- Found By: --- Blocker: --- Created attachment 873384 --> https://bugzilla.suse.com/attachment.cgi?id=873384&action=edit diff from build-compare While working on reproducible builds for openSUSE, I found that our java-21-openjdk binaries vary between 1-core and 4-core builds. https://rb.zq1.de/compare.factory-20240228/diffs/java-21-openjdk-compare.out has the diff (also attached) There may be additional issues from ASLR that I am still investigating. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1218136] New: Add Turkish F layout
by bugzilla_noreply＠suse.com 14 Feb '25

14 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1218136 Bug ID: 1218136 Summary: Add Turkish F layout Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: emir_sari(a)icloud.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Whilst installing Krypton, in the installer, there is no Turkish F layout, which also a common layout in Turkey, and used alongside the Q layout. Please add it as another option in the drop-down list. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1224403] New: bpftrace: ERROR: Error attaching probe: 'kprobe:swap_readpage'
by bugzilla_noreply＠suse.com 14 Feb '25

14 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1224403 Bug ID: 1224403 Summary: bpftrace: ERROR: Error attaching probe: 'kprobe:swap_readpage' Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: petr.vorel(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- bpftrace fails to attach probe: # echo -e "\ninterval:s:5 { exit(); }" | cat /usr/share/bpftrace/tools/swapin.bt - | bpftrace - stdin:1-16: WARNING: swap_readpage is not traceable (either non-existing, inlined, or marked as "notrace"); attaching to it will likely fail Attaching 3 probes... cannot attach kprobe, probe entry may not exist ERROR: Error attaching probe: 'kprobe:swap_readpage' # echo $? 255 It has been failing for some time (at least since 20240412, but probably much longer). -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1217747] New: colord: reproducible builds: icc varies from CPU
by bugzilla_noreply＠suse.com 13 Feb '25

13 Feb '25

https://bugzilla.suse.com/show_bug.cgi?id=1217747 Bug ID: 1217747 Summary: colord: reproducible builds: icc varies from CPU Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://github.com/omgovich/colord/issues/122 OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: gnome-bugs(a)suse.de Blocks: 1100677 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for ALP+openSUSE, I found that our colord package varied from differences in .icc files caused by differences in build machine CPU capabilities (probably AVX) Also filed upstream at https://github.com/omgovich/colord/issues/122 but they seem inactive. You find a reproducer and more details there. -- You are receiving this mail because: You are on the CC list for the bug.

1 4