July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228435] Flatpak app images don't load
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228435 https://bugzilla.suse.com/show_bug.cgi?id=1228435#c1 Richard Brown <rbrown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(mail2chrisb@gmail | |.com) CC| |mail2chrisb(a)gmail.com --- Comment #1 from Richard Brown <rbrown(a)suse.com> --- I'm not able to reproduce this in GNOME Software on any of my Aeon installations All of them find the images just fine with no errors like you see in the journal can you retest and provide output of your /etc/os-release? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228540] [SELinux] avc during boot for init-xenstore-d and qemu-system-i386
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228540 https://bugzilla.suse.com/show_bug.cgi?id=1228540#c2 --- Comment #2 from Johannes Segitz <jsegitz(a)suse.com> --- The directory listing for /var/lib/xen looks a bit weird. For me there are other directories in there. Is that all the content you see? Is that the host itself running on XEN? Please provide the output of rpm -qa | grep xen Thanks -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228540] [SELinux] avc during boot for init-xenstore-d and qemu-system-i386
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228540 https://bugzilla.suse.com/show_bug.cgi?id=1228540#c1 Johannes Segitz <jsegitz(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team(a)suse.de |jsegitz(a)suse.com --- Comment #1 from Johannes Segitz <jsegitz(a)suse.com> --- thanks for the detailed report, I'll have a look -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228420] libzypp 17.35.4 breaks yast2-* build
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228420 https://bugzilla.suse.com/show_bug.cgi?id=1228420#c8 Michael Andres <ma(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #8 from Michael Andres <ma(a)suse.com> --- Another missing symbol and I also found the bug in our script checking whether we lost needed symbols. It now correctly reports the missing symbol in yast2-pkgbindings against libzypp-17.35.4 and reports 17.35.5 as ok. libyui appears to be satisfied even with 17.35.4. Fixed in libzypp-17.35.5. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228385] [SELinux] denial ppp interface during boot
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228385 https://bugzilla.suse.com/show_bug.cgi?id=1228385#c9 --- Comment #9 from Cathy Hu <cathy.hu(a)suse.com> --- hmm okay odd, what does `ls -alZ /usr/libexec/ppp/` say? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228560] New: VUL-0: CVE-2023-45142: rke2-1.27,rke2-1.28: DoS vulnerability
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228560 Bug ID: 1228560 Summary: VUL-0: CVE-2023-45142: rke2-1.27,rke2-1.28: DoS vulnerability Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/381721/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: rbrown(a)suse.com Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de CC: gianluca.gabrielli(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1228553 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1228553 +++ OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it. References: https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisor… https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/int… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45142 https://www.cve.org/CVERecord?id=CVE-2023-45142 https://github.com/advisories/GHSA-cg3q-j54f-5p7p https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49… https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277 https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.… https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisor… https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694… https://bugzilla.redhat.com/show_bug.cgi?id=2245180 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedora… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1228205] [SELinux] need policy for grub2-snapper-plugin
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228205 https://bugzilla.suse.com/show_bug.cgi?id=1228205#c6 Cathy Hu <cathy.hu(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #6 from Cathy Hu <cathy.hu(a)suse.com> --- done, accepted closing -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228281] [SELinux] need policy for snapper plugins
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228281 Bug 1228281 depends on bug 1228205, which changed state. Bug 1228205 Summary: [SELinux] need policy for grub2-snapper-plugin https://bugzilla.suse.com/show_bug.cgi?id=1228205 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219282] Distorted sound with "AMD Family 17h/19h HD Audio" in some applications, apparently occurring under system heavier load
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1219282 https://bugzilla.suse.com/show_bug.cgi?id=1219282#c21 --- Comment #21 from Takashi Iwai <tiwai(a)suse.com> --- I'm rebuilding the kernel again with the revised test patch. It'll have *.gf4f8d95 release number. Although I don't expect this would change further, please verify it later, just to be sure. Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1206869] azure-cli-core requires python3-packaging < 22.0
by bugzilla_noreply＠suse.com 30 Jul '24

30 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1206869 https://bugzilla.suse.com/show_bug.cgi?id=1206869#c7 --- Comment #7 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:1640-2: An update that has two fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20241640-2 Category: recommended (important) Bug References: 1199592, 1206869 Maintenance Incident: [SUSE:Maintenance:33463](https://smelt.suse.de/incident/33463/) Sources used: openSUSE Leap 15.6 (src): python-azure-batch-14.1.0-150400.15.3.1, python-azure-iot-nspkg-1.0.1-150400.9.3.1, python-azure-ai-ml-1.13.0-150400.9.3.2, python-azure-keyvault-nspkg-1.0.0-150400.11.5.1, python-azure-mgmt-servicelinker-1.2.0~b1-150400.10.3.1, python-azure-communication-networktraversal-1.1.0~b1-150400.10.3.1, python-azure-mgmt-timeseriesinsights-1.0.0.0-150400.10.5.1, python-azure-mgmt-advisor-9.0.0-150400.11.5.1, python-azure-mgmt-workloadmonitor-1.0.0~b4-150400.9.3.1, python-azure-mgmt-datalake-store-1.0.0-150400.14.5.1, ... Public Cloud Module 15-SP6 (src): python-azure-batch-14.1.0-150400.15.3.1, python-azure-iot-nspkg-1.0.1-150400.9.3.1, python-azure-ai-ml-1.13.0-150400.9.3.2, python-azure-keyvault-nspkg-1.0.0-150400.11.5.1, python-azure-mgmt-servicelinker-1.2.0~b1-150400.10.3.1, python-azure-communication-networktraversal-1.1.0~b1-150400.10.3.1, python-azure-mgmt-timeseriesinsights-1.0.0.0-150400.10.5.1, python-azure-mgmt-advisor-9.0.0-150400.11.5.1, python-azure-mgmt-workloadmonitor-1.0.0~b4-150400.9.3.1, python-azure-mgmt-datalake-store-1.0.0-150400.14.5.1, ... Public Cloud Module 15-SP5 (src): python-azure-batch-14.1.0-150400.15.3.1, python-azure-iot-nspkg-1.0.1-150400.9.3.1, python-azure-ai-ml-1.13.0-150400.9.3.2, python-azure-keyvault-nspkg-1.0.0-150400.11.5.1, python-azure-mgmt-servicelinker-1.2.0~b1-150400.10.3.1, python-azure-communication-networktraversal-1.1.0~b1-150400.10.3.1, python-azure-mgmt-timeseriesinsights-1.0.0.0-150400.10.5.1, python-azure-mgmt-advisor-9.0.0-150400.11.5.1, python-azure-mgmt-workloadmonitor-1.0.0~b4-150400.9.3.1, python-azure-mgmt-datalake-store-1.0.0-150400.14.5.1, ... openSUSE Leap 15.5 (src): python-azure-batch-14.1.0-150400.15.3.1, python-azure-iot-nspkg-1.0.1-150400.9.3.1, python-azure-ai-ml-1.13.0-150400.9.3.2, python-azure-keyvault-nspkg-1.0.0-150400.11.5.1, python-azure-mgmt-servicelinker-1.2.0~b1-150400.10.3.1, python-azure-communication-networktraversal-1.1.0~b1-150400.10.3.1, python-azure-mgmt-timeseriesinsights-1.0.0.0-150400.10.5.1, python-azure-mgmt-advisor-9.0.0-150400.11.5.1, python-azure-mgmt-workloadmonitor-1.0.0~b4-150400.9.3.1, python-azure-mgmt-datalake-store-1.0.0-150400.14.5.1, ... NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0