August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1229913] New: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229913 Bug ID: 1229913 Summary: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: popov895(a)ukr.net Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1205607 We've been asked to have a fresh look ad kio-admin, formerly rejected in bug 1205607. AFAIK upstream activities to come up with a robust API have been abandoned, but we can still have another look at the current production code. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1229813] New: dbus.socket does not start dbus-broker.service
by bugzilla_noreply＠suse.com 19 Dec '24

19 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229813 Bug ID: 1229813 Summary: dbus.socket does not start dbus-broker.service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Services which require dbus have a dependency on dbus.socket in their service file. dbus-broker has no dbus.service file, thus this dependencies are broken and a boot only succeeds by pure luck. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1226207] New: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226207 Bug ID: 1226207 Summary: breeze-dark (kf6-breeze-icons) symbolic icons aren't recolored and dark though should be light Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- kf6-breeze-icons generate identical icons for both breeze & breeze-dark. While this is not an issue for KF6 apps, that use run-time recoloring, in KF5 apps, like Krusader, when dark color theme is used and icons are breeze-dark symbolic icons are dark on dark background and almost invisible. The reason is this build option: `-DWITH_ICON_GENERATION:BOOL=FALSE` I've tried to make my custom build [1] switching it to TRUE and breeze-dark icons are fine with Krusader now. But I don't know the reasoning behind switching it to FALSE. There is comment: ``` saves ~30MB and installs dangling symlinks ``` Less size is true, though IMHO it's not a good solution to break KF5 apps to save some space. But I can't see any dangling symlinks: ``` find /usr/share/icons/breeze{,-dark} -xtype l ``` doesn't find anything. Any other reason or should I cleanup [1] and make a submit request? [1] https://build.opensuse.org/package/show/home:NickLion:branches:KDE:Framewor… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1221568] New: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1221568 Bug ID: 1221568 Summary: VUL-0: CVE-2024-22513: python-djangorestframework-simplejwt: information disclosure via inactive user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393624/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mmachova(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22513 https://www.zerodayinitiative.com/advisories/ZDI-24-101/ https://www.cve.org/CVERecord?id=CVE-2024-22513 https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513 https://bugzilla.redhat.com/show_bug.cgi?id=2269822 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1228868] New: Incorrect count of requests in `call_count`
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1228868 Bug ID: 1228868 Summary: Incorrect count of requests in `call_count` Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: ahasenkopf(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876481 --> https://bugzilla.suse.com/attachment.cgi?id=876481&action=edit Small script to reproduce the bug The `call_count` attribute of mocks differs from upstream packages. When using `urllib3.Retry` and using `responses` to mock a request, the resulting call count is wrong. With the attached example script, all Python versions and upstream packages from PyPI result in a call count of 7. On Leap 15.5 and Leap 15.6 the value is 11. Installed RPMs (excerpt): * python3-base-3.6.15-150300.10.65.1.x86_64 * libpython3_6m1_0-3.6.15-150300.10.65.1.x86_64 * python3-3.6.15-150300.10.65.2.x86_64 * python3-urllib3-1.25.10-150300.4.9.1.noarch * python3-requests-2.25.1-150300.3.6.1.noarch * python3-responses-0.21.0-150300.3.3.1.noarch Steps to reproduce: ``` docker run -it --rm registry.opensuse.org/opensuse/leap:15.6 zypper in python3-responses python3 <path-to-example-script> ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1229551] New: django-webtest: Enable sle15_python_module_pythons
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229551 Bug ID: 1229551 Summary: django-webtest: Enable sle15_python_module_pythons Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: egotthold(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- My application (Orthos 2) cannot be installed on Leap since it requires django-webtest, which is unavailable with Python 3.11. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1229450] New: libbpf: failed to find '.BTF' ELF section in vmlinux
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229450 Bug ID: 1229450 Summary: libbpf: failed to find '.BTF' ELF section in vmlinux Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876820 --> https://bugzilla.suse.com/attachment.cgi?id=876820&action=edit Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586 build log The kernel builds result in random build failures while creating BTF. For example https://build.opensuse.org/package/live_build_log/Kernel:vanilla/kernel-sou…: > libbpf: failed to find '.BTF' ELF section in vmlinux > FAILED: load BTF from vmlinux: No data available > make[2]: *** [../scripts/Makefile.vmlinux:34: vmlinux] Error 255 > make[2]: *** Deleting file 'vmlinux' > make[1]: *** [/home/abuild/rpmbuild/BUILD/kernel-vanilla-6.11~rc3.338.gc3f2d783a459/linux-6.11-rc3-338-gc3f2d783a459/Makefile:1158: vmlinux] Error 2 > make: *** [../Makefile:224: __sub-make] Error 2 > error: Bad exit status from /var/tmp/rpm-tmp.olf5Nu (%build) arm seems to fail reliably. But for example in ibs://Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586, it looks like it is sort of random. kernel-debug and kernel-vanilla fails for i586, but -default and -pae are built currently. See the job history for kernel-vanilla in there (the failed boot log is attached): > time package reason code build time worker > 2024-07-15 07:41:48 kernel-source:kernel-vanilla source change succeeded 47m 53s h01-ch5a:3 > 2024-07-15 23:56:48 kernel-source:kernel-vanilla source change succeeded 47m 57s h01-ch5b:5 > 2024-07-18 11:12:40 kernel-source:kernel-vanilla source change succeeded 48m 46s h01-ch5b:2 > 2024-07-26 20:01:29 kernel-source:kernel-vanilla source change succeeded 52m 40s h01-ch4b:2 > 2024-07-29 09:07:35 kernel-source:kernel-vanilla source change succeeded 52m 53s h01-ch4a:6 > 2024-08-03 11:38:55 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch4b:8 > 2024-08-04 23:48:15 kernel-source:kernel-vanilla source change failed 25m 14s h01-ch4b:7 > 2024-08-06 16:37:35 kernel-source:kernel-vanilla source change succeeded 53m 25s h01-ch4b:4 > 2024-08-09 19:44:44 kernel-source:kernel-vanilla source change failed 26m 4s h01-ch5a:2 > 2024-08-11 22:48:56 kernel-source:kernel-vanilla source change failed 0m 38s h01-ch4b:6 > 2024-08-12 16:44:52 kernel-source:kernel-vanilla source change succeeded 54m 0s h01-ch5b:5 > 2024-08-15 21:49:11 kernel-source:kernel-vanilla source change failed 25m 25s h01-ch4b:1 > 2024-08-19 01:53:01 kernel-source:kernel-vanilla source change succeeded 50m 9s h01-ch4a:5 > 2024-08-19 11:33:50 kernel-source:kernel-vanilla source change succeeded 55m 9s h01-ch5b:1 > 2024-08-19 17:23:59 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch5a:3 -- You are receiving this mail because: You are on the CC list for the bug.

1 34

[Bug 1222314] New: YaST doesn't set zypper locales during installation
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1222314 Bug ID: 1222314 Summary: YaST doesn't set zypper locales during installation Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: fvogt(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 874066 --> https://bugzilla.suse.com/attachment.cgi?id=874066&action=edit YaST installation logs I installed YaST with German locale. While the system has the locale configured as expected (e.g. /etc/locale.conf), zypper does not: ~> sudo zypper locales Code | Language | Requested -----+----------+---------- As a result, language specific packages are missing. -- You are receiving this mail because: You are on the CC list for the bug.

1 51

[Bug 1212877] New: [RPi4] cannot wake up after suspend triggered
by bugzilla_noreply＠suse.com 17 Dec '24

17 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1212877 Bug ID: 1212877 Summary: [RPi4] cannot wake up after suspend triggered Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 867900 --> https://bugzilla.suse.com/attachment.cgi?id=867900&action=edit yast2 logs ssh to my RPi 4 Model B, later I see following -- p200300ea3707b36b055205817bcf9853:~ # Broadcast message from root@localhost (Fri 2023-06-30 06:03:37 UTC): The system will suspend now! -- then I try to wake it up by hitting keyboard and click on mouse, nothing happened on screen. attache yast2logs. -- You are receiving this mail because: You are on the CC list for the bug.

1 1