January 2025 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1220571] New: [META] Packages failing because GCC 14+ treats some warnings as errors
by bugzilla_noreply＠suse.com 21 Mar '25

21 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1220571 Bug ID: 1220571 Summary: [META] Packages failing because GCC 14+ treats some warnings as errors Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mjambor(a)suse.com Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- GCC 14 treats the following situations, which were only warnings before, as errors: -Werror=implicit-int -Werror=implicit-function-declaration -Werror=declaration-missing-parameter-type -Werror=return-mismatch -Werror=int-conversion -Werror=incompatible-pointer-types More details about all of these cases together with the most common ways of addressing them and some associated pitfalls is available at https://gcc.gnu.org/gcc-14/porting_to.html For the record, clang has taken a similar step since clang 16, see for example https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16 The preferred method of dealing with these issues is of course fixing the code. Other distributions have shared patches from their porting efforts on relevant upstream mailing lists and bug trackers, Gentoo and RedHat are perhaps most active in this regard, so you can have a look at what they did for their packages at: - https://bugs.gentoo.org/showdependencytree.cgi?id=870412&hide_resolved=0 - https://gitlab.com/fweimer-rh/fedora-modernc/ In case there is for some reason not possible to fix the code, or at least to fix it in time for adoption of GCC 14, it is possible to turn these back to warnings by adding to the compiler options one of the following: -std=gnu89, -std=c89, or -fpermissive. (Especially if you use -fpermissive as a temporary workaround with intention to fix the underlying issues later, I'd suggest leaving the particular bug opened until it is done so.) -- You are receiving this mail because: You are on the CC list for the bug.

1 116

[Bug 1228342] New: Package texlive does not build with gcc 14 on i586 because of use of incompatible pointer types
by bugzilla_noreply＠suse.com 21 Mar '25

21 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1228342 Bug ID: 1228342 Summary: Package texlive does not build with gcc 14 on i586 because of use of incompatible pointer types Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de CC: werner(a)suse.com Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Package texlive fails to build with GCC 14 on i586 (and probably othr 32bit architectures too) because of various C99 violations which previously just generated warning s but which cause errors with GCC 14 by default (see meta bug#1220571). The (first) problem stopping the build is: pdftexini.c: In function 'loadfmtfile': pdftexini.c:4016:25: error: assignment to 'boolean *' {aka 'int *'} from incompatible pointer type 'internalfontnumber ' {aka 'long int *'} [-Wincompatible-pointer-types] 4016 | pdffonthasspacechar = xmallocarray ( internalfontnumber , fontmax ) ; | ^ pdftexini.c: In function 'mainbody': pdftexini.c:5569:27: error: assignment to 'boolean *' {aka 'int *'} from incompatible pointer type 'internalfontnumber ' {aka 'long int *'} [-Wincompatible-pointer-types] 5569 | pdffonthasspacechar = xmallocarray ( internalfontnumber , fontmax ) ; | ^ so IIUC double the necessary size is allocated rater than just half but it looks like a genuine type issue. We can work-around the issue by building with -Wno-error=incompatible-pointer-types (on 32 bit architectures) but it is always better to fix these issues. I admit that so far I am super puzzled where the file texk/web2c/pdftexini.c comes from (or rather how it is generated?) so I'd be grateful if someone who knows the package better looked at this. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1235367] New: VUL-0: CVE-2024-45338: gitea-tea: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content
by bugzilla_noreply＠suse.com 20 Mar '25

20 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1235367 Bug ID: 1235367 Summary: VUL-0: CVE-2024-45338: gitea-tea: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/433408/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-45338:5.9:(AV:N/AC:H/PR:N/UI:N/ S:U/C:N/I:N/A:H) CVSSv4:SUSE:CVE-2024-45338:8.2:(AV:N/AC:H/AT:P/PR:N/UI :N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1234794 Target Milestone: --- Found By: --- Blocker: --- An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45338 https://www.cve.org/CVERecord?id=CVE-2024-45338 https://go.dev/cl/637536 https://go.dev/issue/70906 https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ https://pkg.go.dev/vuln/GO-2024-3333 https://bugzilla.redhat.com/show_bug.cgi?id=2333122 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234598] New: VUL-0: CVE-2024-45337: gitea-tea: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 20 Mar '25

20 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1234598 Bug ID: 1234598 Summary: VUL-0: CVE-2024-45337: gitea-tea: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/432234/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/ S:U/C:H/I:H/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1234482 Target Milestone: --- Found By: --- Blocker: --- Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45337 https://www.cve.org/CVERecord?id=CVE-2024-45337 https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb… https://go.dev/cl/635315 https://go.dev/issue/70779 https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ https://pkg.go.dev/vuln/GO-2024-3321 http://www.openwall.com/lists/oss-security/2024/12/11/2 https://bugzilla.redhat.com/show_bug.cgi?id=2331720 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1226194] New: Make JeOS images work with u-boot BOOTSTD
by bugzilla_noreply＠suse.com 20 Mar '25

20 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1226194 Bug ID: 1226194 Summary: Make JeOS images work with u-boot BOOTSTD Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: mbrugger(a)suse.com Reporter: schwab(a)suse.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- U-Boot configurations that use CONFIG_BOOTSTD_DEFAULTS or CONFIG_BOOTSTD_FULL no longer find the device tree file on the disk (they pass on the builtin device tree instead). Either the patch 0001-XXX-openSUSE-XXX-Prepend-partition-.patch needs to be ported to BOOTSTD or the boot setup needs to be changed. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1233167] New: [Build 20241109] Mesa 24.2.x - shifted colors on s390x
by bugzilla_noreply＠suse.com 20 Mar '25

20 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1233167 Bug ID: 1233167 Summary: [Build 20241109] Mesa 24.2.x - shifted colors on s390x Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/4634296/modules/boot loader_start/steps/33 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation We have a color shift when installing on an s390x mainframe; introduced with Mesa 24.2.x openQA test in scenario opensuse-Tumbleweed-DVD-s390x-autoyast_zvm@s390x-zVM-vswitch-l2 fails in [bootloader_start](https://openqa.opensuse.org/tests/4634296/modules/bootloa… ## Test suite description Create HDD for s390x textmode ## Reproducible Fails since (at least) Build [20241109](https://openqa.opensuse.org/tests/4633979) ## Expected result Last good: [20241105](https://openqa.opensuse.org/tests/4622286) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=s390x&distri=opensuse… -- You are receiving this mail because: You are on the CC list for the bug.

1 26

[Bug 1236308] New: installation-images: remove dependency on nscd
by bugzilla_noreply＠suse.com 20 Mar '25

20 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1236308 Bug ID: 1236308 Summary: installation-images: remove dependency on nscd Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: locilka(a)suse.com QA Contact: jsrain(a)suse.com CC: dimstar(a)opensuse.org, jsrain(a)suse.com, snwint(a)suse.com Depends on: 1236238 Blocks: 1235247 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1236238 +++ Continuation of bug 1235247 nscd is being removed from Tumbleweed and newer distributions. It's already been removed from Tumbleweed default installations a while ago, as it is not compatible with modern technologies and the main consumer, NIS, has been removed too These YaST modules seem to be affected: - Users - Samba Client - Auth Client - Samba Server - NIS Client https://github.com/search?q=org%3Ayast+nscd+language%3ARuby&type=code&l=Ruby https://github.com/search?q=org%3Ayast+nscd+language%3APerl&type=code&l=Perl -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1229450] New: libbpf: failed to find '.BTF' ELF section in vmlinux
by bugzilla_noreply＠suse.com 19 Mar '25

19 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1229450 Bug ID: 1229450 Summary: libbpf: failed to find '.BTF' ELF section in vmlinux Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876820 --> https://bugzilla.suse.com/attachment.cgi?id=876820&action=edit Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586 build log The kernel builds result in random build failures while creating BTF. For example https://build.opensuse.org/package/live_build_log/Kernel:vanilla/kernel-sou…: > libbpf: failed to find '.BTF' ELF section in vmlinux > FAILED: load BTF from vmlinux: No data available > make[2]: *** [../scripts/Makefile.vmlinux:34: vmlinux] Error 255 > make[2]: *** Deleting file 'vmlinux' > make[1]: *** [/home/abuild/rpmbuild/BUILD/kernel-vanilla-6.11~rc3.338.gc3f2d783a459/linux-6.11-rc3-338-gc3f2d783a459/Makefile:1158: vmlinux] Error 2 > make: *** [../Makefile:224: __sub-make] Error 2 > error: Bad exit status from /var/tmp/rpm-tmp.olf5Nu (%build) arm seems to fail reliably. But for example in ibs://Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586, it looks like it is sort of random. kernel-debug and kernel-vanilla fails for i586, but -default and -pae are built currently. See the job history for kernel-vanilla in there (the failed boot log is attached): > time package reason code build time worker > 2024-07-15 07:41:48 kernel-source:kernel-vanilla source change succeeded 47m 53s h01-ch5a:3 > 2024-07-15 23:56:48 kernel-source:kernel-vanilla source change succeeded 47m 57s h01-ch5b:5 > 2024-07-18 11:12:40 kernel-source:kernel-vanilla source change succeeded 48m 46s h01-ch5b:2 > 2024-07-26 20:01:29 kernel-source:kernel-vanilla source change succeeded 52m 40s h01-ch4b:2 > 2024-07-29 09:07:35 kernel-source:kernel-vanilla source change succeeded 52m 53s h01-ch4a:6 > 2024-08-03 11:38:55 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch4b:8 > 2024-08-04 23:48:15 kernel-source:kernel-vanilla source change failed 25m 14s h01-ch4b:7 > 2024-08-06 16:37:35 kernel-source:kernel-vanilla source change succeeded 53m 25s h01-ch4b:4 > 2024-08-09 19:44:44 kernel-source:kernel-vanilla source change failed 26m 4s h01-ch5a:2 > 2024-08-11 22:48:56 kernel-source:kernel-vanilla source change failed 0m 38s h01-ch4b:6 > 2024-08-12 16:44:52 kernel-source:kernel-vanilla source change succeeded 54m 0s h01-ch5b:5 > 2024-08-15 21:49:11 kernel-source:kernel-vanilla source change failed 25m 25s h01-ch4b:1 > 2024-08-19 01:53:01 kernel-source:kernel-vanilla source change succeeded 50m 9s h01-ch4a:5 > 2024-08-19 11:33:50 kernel-source:kernel-vanilla source change succeeded 55m 9s h01-ch5b:1 > 2024-08-19 17:23:59 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch5a:3 -- You are receiving this mail because: You are on the CC list for the bug.

1 38

[Bug 1233887] New: Have installer not set enforcing=1 in grub config, so /etc/selinux/config is ignored
by bugzilla_noreply＠suse.com 18 Mar '25

18 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1233887 Bug ID: 1233887 Summary: Have installer not set enforcing=1 in grub config, so /etc/selinux/config is ignored Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: jsegitz(a)suse.com QA Contact: jsrain(a)suse.com CC: cathy.hu(a)suse.com, mmeisters(a)suse.com, security-team(a)suse.de Depends on: 1232496 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1232496 +++ sl micro 5.5 has enforcing=1 in grub config, so /etc/selinux/config is ignored should be removed, otherwise it is confusing for users why changing /etc/selinux/config does not do anything -- You are receiving this mail because: You are on the CC list for the bug.

1 18

[Bug 1235162] New: VUL-0: CVE-2023-49295: kubo: github.com/quic-go/quic-go: memory exhaustion attack against QUIC's path validation mechanism
by bugzilla_noreply＠suse.com 18 Mar '25

18 Mar '25

https://bugzilla.suse.com/show_bug.cgi?id=1235162 Bug ID: 1235162 Summary: VUL-0: CVE-2023-49295: kubo: github.com/quic-go/quic-go: memory exhaustion attack against QUIC's path validation mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/390776/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2023-49295:6.5:(AV:N/AC:L/PR:L/UI:N/ S:U/C:N/I:N/A:H) CVSSv4:SUSE:CVE-2023-49295:6.0:(AV:N/AC:L/AT:P/PR:L/UI :N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) Severity: Normal Priority: P5 - None Component: Security Assignee: bwiedemann(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1234982 Target Milestone: --- Found By: --- Blocker: --- quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-49295 https://www.cve.org/CVERecord?id=CVE-2023-49295 https://github.com/quic-go/quic-go/commit/17fc98c2d81dbe685c19702dc694a9d60… https://github.com/quic-go/quic-go/commit/21609ddfeff93668c7625a85eb09f1541… https://github.com/quic-go/quic-go/commit/3a9c18bcd27a01c551ac9bf8bd2b4bded… https://github.com/quic-go/quic-go/commit/554d543b50b917369fb1394cc5396d928… https://github.com/quic-go/quic-go/commit/6cc3d58935426191296171a6c0d1ee965… https://github.com/quic-go/quic-go/commit/9aaefe19fc3dc8c8917cc87e6128bb56d… https://github.com/quic-go/quic-go/commit/a0ffa757499913f7be69aa78f573a6aee… https://github.com/quic-go/quic-go/commit/d7aa627ebde91cf799ada2a07443faa9b… https://github.com/quic-go/quic-go/security/advisories/GHSA-ppxx-5m9h-6vxf https://bugzilla.redhat.com/show_bug.cgi?id=2257815 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedora… https://lists.fedoraproject.org/archives/list/package-announce@lists.fedora… -- You are receiving this mail because: You are on the CC list for the bug.

1 4