July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225965] New: Improve KDE Discover bug reporting button
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1225965 Bug ID: 1225965 Summary: Improve KDE Discover bug reporting button Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: shundhammer(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Whenever we have a generic package issues that affects multiple users like (bug 1225174), we get a whole to of bug reports and duplicates. All that users seem to be doing is copy the text "<html>Dependency resolution failed:<br/><br/>[...] </html>", report a bug in a random component. Bonus: If the component is YaST, Huha gets angry like in bug 1225949. We do not see the bugs that were not reported due to bugzilla pointing out the possible duplicate, but in the example above we got 14 reports. These users may or may not have read through the duplicated bug, or read the recommendation there. https://github.com/KDE/discover/blob/d644b2a1000c04f084d39a4ef8a3402abf6417… Let's improve user experience here. Some ideas: 0. Direct the user to zypper/YaST for self-service resolution of the conflict. 1. Direct the user to a landing page with instructions for #0. 2. Direct the user to bugzilla search first 3. Take the message - extract package names only, strip arch/installed version, sort, and make a hash from it. Use that as the bug alias for automatic reduplication. 4. or even a fuzzy hash 5. Use a bugzilla whiteboard field with self-service fix instructions -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1227364] New: trackerbug: packages build differently without %check
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1227364 Bug ID: 1227364 Summary: trackerbug: packages build differently without %check Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bwiedemann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1081754 Target Milestone: --- Found By: Development Blocker: --- The %check section in a .spec file runs scripts that may modify the package output. Some packages fail to build with osc build --nocheck and some others produce different build results. Both of these cases make reproducible-builds harder and are considered bugs. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226101] New: Joystick and steering wheel not found in system settings
by bugzilla_noreply＠suse.com 07 Dec '24

07 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226101 Bug ID: 1226101 Summary: Joystick and steering wheel not found in system settings Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: Michael.Zapf(a)mizapf.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The Plasma System Settings do not show any game controllers, although there is a digital joystick (connected via a Hexagons USB adapter) and a Logitech G25 steering wheel connected. It only shows a XBox game controller when plugged it. The settings were present for the Joystick and the steering wheel in some earlier release (unknown). The devices are found by the system (as dmesg states) and are usable in games, but cannot be configured in KDE. Contrary to the advice in the help file, there is no way to add a non-detected device in the settings. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1227710] New: NetworkManager-openvpn must use --data-ciphers for OpenVPN >= 2.6
by bugzilla_noreply＠suse.com 06 Dec '24

06 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1227710 Bug ID: 1227710 Summary: NetworkManager-openvpn must use --data-ciphers for OpenVPN >= 2.6 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/ -/issues/97 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: adrian.glaubitz(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Recently, one of my OpenVPN connections stopped working with every connection attempt timing out. After some debugging and research, I figured out that the reason is that OpenVPN 2.6 deprecated the "--cipher" option and replaced it with "--data-ciphers". There is an upstream bug report which tracks the issue: > https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/issues/97 While there have been changes made to the code to address this issue, > https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/commit/963b71a83ee1… > https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/commit/020ab0c4b872… the issue doesn't seem to be resolved yet as my own experiences and the comments of other users in the above upstream bug report suggest. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1213380] New: Black Screen Issue on openSUSE Tumbleweed ISO after BIOS with DP-HDMI Video Output
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1213380 Bug ID: 1213380 Summary: Black Screen Issue on openSUSE Tumbleweed ISO after BIOS with DP-HDMI Video Output Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: samcon(a)protonmail.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- I encountered a black screen issue while attempting to boot the openSUSE Tumbleweed ISO after the BIOS on my system. This issue specifically occurs when using a DP-HDMI video output. This problem does not arise when using the same video output with other operating systems like Leap, Fedora, and Ubuntu LTS. In those cases, I am able to get video output without any black screen problems. Steps to Reproduce: 1. Start the computer and access the BIOS. 2. Configure the boot order to prioritize booting from the openSUSE Tumbleweed ISO. 3. Save the changes and exit the BIOS. 4. The system attempts to boot from the ISO. 5. First I see the kernal or bootloader messages, then it jumps to a black screen - with waiting for source message on projector. Expected Behavior: Upon booting from the openSUSE Tumbleweed ISO, the system should display zypper installer instead of a black screen, just like other operating systems do when using the DP-HDMI video output. Additional Information: - Operating System: openSUSE Tumbleweed - Video Output: DP-HDMI - Other operating systems (Leap, Fedora, Ubuntu LTS) do not exhibit the black screen issue with the same video output. - When I connect the same system to the monitor using DP-to-DP instead of DP-to-HDMI, the video output is successfully displayed. - Have used tried with iso from few weeks back and latest Snapshot20230714-Media.iso Kind regards, Sam -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1215927] New: kernel-default-6.5.4 reboots instead of resuming from suspend
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1215927 Bug ID: 1215927 Summary: kernel-default-6.5.4 reboots instead of resuming from suspend Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: psychonaut(a)nothingisreal.com QA Contact: qa-bugs(a)suse.de CC: mrmazda(a)earthlink.net Target Milestone: --- Found By: --- Blocker: --- I upgraded from Tumbleweed 20230908 to 20230921, which included an upgrade from kernel-default-6.4.12 to kernel-default-6.5.4. I always suspend my computer at night (with systemctl suspend) and wake it the next morning. With the new kernel, the computer always restarts instead of resuming from suspend. The problem does not occur with the old kernel. Interestingly, the problem is reproducible only when I leave the computer suspended overnight. Simply suspending the computer and then waking it a few seconds later does not trigger the bug. hwinfo output (with the old kernel) is available in Attachment 869836 of Bug 1215826. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1219444] New: amdgpu critical error
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219444 Bug ID: 1219444 Summary: amdgpu critical error Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: teuniz(a)protonmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 872372 --> https://bugzilla.suse.com/attachment.cgi?id=872372&action=edit Output of dmesg The kernel crashes approx every 5 minutes. I reverted back to kernel 5.14.21-150500.55.19-default because with that one it crashes approx once a day. Operating System: openSUSE Leap 15.5 KDE Plasma Version: 5.27.9 KDE Frameworks Version: 5.103.0 Qt Version: 5.15.8 Kernel Version: 5.14.21-150500.55.44-default (64-bit) Graphics Platform: X11 Processors: 32 × 13th Gen Intel Core i9-13900K Memory: 31.0 GiB of RAM Graphics Processor: AMD Radeon Pro W6600 Manufacturer: HP Product Name: HP Z2 Tower G9 Workstation Desktop PC dmesg | grep amdgpu [ 1.540640] [drm] amdgpu kernel modesetting enabled. [ 1.540703] amdgpu: CRAT table not found [ 1.540705] amdgpu: Virtual CRAT table created for CPU [ 1.540712] amdgpu: Topology: Add CPU node [ 1.542670] amdgpu 0000:03:00.0: amdgpu: Fetched VBIOS from VFCT [ 1.542671] amdgpu: ATOM BIOS: 113-D5330400-100 [ 1.542770] amdgpu 0000:03:00.0: vgaarb: deactivate vga console [ 1.542771] amdgpu 0000:03:00.0: amdgpu: Trusted Memory Zone (TMZ) feature disabled as experimental (default) [ 1.542799] amdgpu 0000:03:00.0: amdgpu: VRAM: 8176M 0x0000008000000000 - 0x00000081FEFFFFFF (8176M used) [ 1.542800] amdgpu 0000:03:00.0: amdgpu: GART: 512M 0x0000000000000000 - 0x000000001FFFFFFF [ 1.542801] amdgpu 0000:03:00.0: amdgpu: AGP: 267894784M 0x0000008400000000 - 0x0000FFFFFFFFFFFF [ 1.542845] [drm] amdgpu: 8176M of VRAM memory ready [ 1.542845] [drm] amdgpu: 15892M of GTT memory ready. [ 1.548699] amdgpu 0000:03:00.0: amdgpu: PSP runtime database doesn't exist [ 1.548704] amdgpu 0000:03:00.0: amdgpu: PSP runtime database doesn't exist [ 2.854516] amdgpu 0000:03:00.0: amdgpu: STB initialized to 2048 entries [ 2.895100] amdgpu 0000:03:00.0: amdgpu: Will use PSP to load VCN firmware [ 3.094413] amdgpu 0000:03:00.0: amdgpu: RAS: optional ras ta ucode is not available [ 3.115717] amdgpu 0000:03:00.0: amdgpu: SECUREDISPLAY: securedisplay ta ucode is not available [ 3.115740] amdgpu 0000:03:00.0: amdgpu: smu driver if version = 0x0000000f, smu fw if version = 0x00000013, smu fw program = 0, version = 0x003b2b00 (59.43.0) [ 3.115745] amdgpu 0000:03:00.0: amdgpu: SMU driver if version not matched [ 3.115777] amdgpu 0000:03:00.0: amdgpu: use vbios provided pptable [ 3.165133] amdgpu 0000:03:00.0: amdgpu: SMU is initialized successfully! [ 3.268063] kfd kfd: amdgpu: Allocated 3969056 bytes on gart [ 3.268478] amdgpu: sdma_bitmap: ffff [ 3.302091] amdgpu: HMM registered 8176MB device memory [ 3.302135] amdgpu: SRAT table not found [ 3.302136] amdgpu: Virtual CRAT table created for GPU [ 3.302599] amdgpu: Topology: Add dGPU node [0x73e3:0x1002] [ 3.302601] kfd kfd: amdgpu: added device 1002:73e3 [ 3.302617] amdgpu 0000:03:00.0: amdgpu: SE 2, SH per SE 2, CU per SH 8, active_cu_number 28 [ 3.302658] amdgpu 0000:03:00.0: amdgpu: ring gfx_0.0.0 uses VM inv eng 0 on hub 0 [ 3.302659] amdgpu 0000:03:00.0: amdgpu: ring comp_1.0.0 uses VM inv eng 1 on hub 0 [ 3.302659] amdgpu 0000:03:00.0: amdgpu: ring comp_1.1.0 uses VM inv eng 4 on hub 0 [ 3.302660] amdgpu 0000:03:00.0: amdgpu: ring comp_1.2.0 uses VM inv eng 5 on hub 0 [ 3.302660] amdgpu 0000:03:00.0: amdgpu: ring comp_1.3.0 uses VM inv eng 6 on hub 0 [ 3.302661] amdgpu 0000:03:00.0: amdgpu: ring comp_1.0.1 uses VM inv eng 7 on hub 0 [ 3.302661] amdgpu 0000:03:00.0: amdgpu: ring comp_1.1.1 uses VM inv eng 8 on hub 0 [ 3.302662] amdgpu 0000:03:00.0: amdgpu: ring comp_1.2.1 uses VM inv eng 9 on hub 0 [ 3.302662] amdgpu 0000:03:00.0: amdgpu: ring comp_1.3.1 uses VM inv eng 10 on hub 0 [ 3.302663] amdgpu 0000:03:00.0: amdgpu: ring kiq_2.1.0 uses VM inv eng 11 on hub 0 [ 3.302663] amdgpu 0000:03:00.0: amdgpu: ring sdma0 uses VM inv eng 12 on hub 0 [ 3.302664] amdgpu 0000:03:00.0: amdgpu: ring sdma1 uses VM inv eng 13 on hub 0 [ 3.302665] amdgpu 0000:03:00.0: amdgpu: ring vcn_dec_0 uses VM inv eng 0 on hub 1 [ 3.302665] amdgpu 0000:03:00.0: amdgpu: ring vcn_enc_0.0 uses VM inv eng 1 on hub 1 [ 3.302666] amdgpu 0000:03:00.0: amdgpu: ring vcn_enc_0.1 uses VM inv eng 4 on hub 1 [ 3.302666] amdgpu 0000:03:00.0: amdgpu: ring jpeg_dec uses VM inv eng 5 on hub 1 [ 3.303573] [drm] Initialized amdgpu 3.49.0 20150101 for 0000:03:00.0 on minor 0 [ 3.308709] fbcon: amdgpudrmfb (fb0) is primary device [ 3.505728] amdgpu 0000:03:00.0: amdgpu: [mmhub] page fault (src_id:0 ring:157 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 3.505731] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000006004000 from client 0x12 (VMC) [ 3.505733] amdgpu 0000:03:00.0: amdgpu: MMVM_L2_PROTECTION_FAULT_STATUS:0x0000073A [ 3.505733] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: DCEDMC (0x3) [ 3.505734] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 3.505735] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x5 [ 3.505735] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x3 [ 3.505735] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x1 [ 3.505736] amdgpu 0000:03:00.0: amdgpu: RW: 0x0 [ 3.524299] amdgpu 0000:03:00.0: [drm] fb0: amdgpudrmfb frame buffer device [ 4.537456] snd_hda_intel 0000:03:00.1: bound 0000:03:00.0 (ops amdgpu_dm_audio_component_bind_ops [amdgpu]) [ 5.416287] amdgpu 0000:03:00.0: amdgpu: [mmhub] page fault (src_id:0 ring:157 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 5.416312] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000006004000 from client 0x12 (VMC) [ 5.416319] amdgpu 0000:03:00.0: amdgpu: MMVM_L2_PROTECTION_FAULT_STATUS:0x00000000 [ 5.416324] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: unknown (0x0) [ 5.416329] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 5.416333] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x0 [ 5.416336] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x0 [ 5.416340] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x0 [ 5.416343] amdgpu 0000:03:00.0: amdgpu: RW: 0x0 [ 73.156519] amdgpu 0000:03:00.0: amdgpu: [mmhub] page fault (src_id:0 ring:157 vmid:0 pasid:0, for process pid 0 thread pid 0) [ 73.156538] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000006004000 from client 0x12 (VMC) [ 73.156546] amdgpu 0000:03:00.0: amdgpu: MMVM_L2_PROTECTION_FAULT_STATUS:0x0000073A [ 73.156551] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: DCEDMC (0x3) [ 73.156562] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x0 [ 73.156566] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x5 [ 73.156570] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x3 [ 73.156578] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x1 [ 73.156582] amdgpu 0000:03:00.0: amdgpu: RW: 0x0 uname -a 5.14.21-150500.55.44-default #1 SMP PREEMPT_DYNAMIC Mon Jan 15 10:03:40 UTC 2024 (cc7d8b6) x86_64 x86_64 x86_64 GNU/Linux lspci VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Navi 23 WKS-XL [Radeon PRO W6600] -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1227273] New: VUL-0: CVE-2024-39303: Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ...
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1227273 Bug ID: 1227273 Summary: VUL-0: CVE-2024-39303: Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ... Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/412574/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mcepl(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39303 https://www.cve.org/CVERecord?id=CVE-2024-39303 https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a… https://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1219137] New: qemu user space builds broken with kernel 6.7
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219137 Bug ID: 1219137 Summary: qemu user space builds broken with kernel 6.7 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: schwab(a)suse.de QA Contact: qa-bugs(a)suse.de CC: adrian.schroeter(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Since commit 1c5976ef0f7a the kernel deregisters all binfmt_misc handler when the binfmt_misc filesystem is unmounted. The build script has this: # RPM specific post checks are in /usr/lib/build/checks if test -n "$RPMS" -a -d "$BUILD_ROOT/usr/lib/build/checks" ; then # workaround for broken 13.1 check scripts which umount /proc if test -n "$RUNNING_IN_VM" -a "$BUILD_ROOT" = / ; then umount -n $BUILD_ROOT/proc/sys/fs/binfmt_misc 2>/dev/null fi This means that after this point the emulation no longer works. [ 272s] ... checking for files with abuild user/group [ 272s] /.build/build: line 1922: /bin/env: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error [ 272s] /.build/build: line 1926: /bin/rpm: cannot execute binary file: Exec format error According to the commit, this should be reported as a regression so that this behaviour is reverted for the initial binfmt_misc mount. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1224383] New: VUL-0: CVE-2024-4068: python-pydata-sphinx-theme: the npm package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS)
by bugzilla_noreply＠suse.com 05 Dec '24

05 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1224383 Bug ID: 1224383 Summary: VUL-0: CVE-2024-4068: python-pydata-sphinx-theme: the npm package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405384/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: gabriele.sonnu(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- The NPM package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4067 https://www.cve.org/CVERecord?id=CVE-2024-4067 https://devhub.checkmarx.com/cve-details/CVE-2024-4067/ https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0… https://github.com/micromatch/micromatch/issues/243 https://github.com/micromatch/micromatch/pull/247 -- You are receiving this mail because: You are on the CC list for the bug.

1 6