January 2025 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1235659] AUDIT-0: fwupd: new polkit action ins version 2.0
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235659 https://bugzilla.suse.com/show_bug.cgi?id=1235659#c6 --- Comment #6 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to dimstar(a)opensuse.org from comment #5) > Just rebuilt in my branch > > There is still one polkit related error showing up: > > [ 172s] fwupd.x86_64: E: polkit-user-privilege (Badness: 10000) org.freedesktop.fwupd.emulation-load (auth_admin:no:yes) > > that one was indeed not part of https://github.com/openSUSE/polkit-default-privs/commit/210cd19ca8efe7a2001… Darn, this must have escaped me, since there is a newline between this action and the rest of the block of actions listed in comment 0. I'll send out a follow-up to address this. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234775] [Build 20241220] openQA test fails in start_install
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234775 https://bugzilla.suse.com/show_bug.cgi?id=1234775#c10 --- Comment #10 from Lukas Ocilka <locilka(a)suse.com> --- I'm afraid that we can't invest our precious time into "making it work with 1GB of RAM" today and we will not be able to do it even tomorrow. DimStar, is there a real need for a "must have" like this? From my point of view, a VM with 1 GB works with an image and real HW usually has much more nowadays. Moreover, as written by HuHa: If Qt does not work, the system can still be installed with ncurses, zram enabled, etc. Every additional library, Kernel firmware, libzypp cache or called binary takes a bit more. Such investment into lower requirements would not pay off mid to long-term anyway. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1235797] [Build 20250108-SELinux] openQA test fails in openqa_bootstrap
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235797 Gayane Osipyan <gayane.osipyan(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |gayane.osipyan(a)suse.com Assignee|security-team(a)suse.de |gayane.osipyan(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1233517] VUL-0: CVE-2025-23013: pam_u2f: problematic PAM_IGNORE return values in `pam_sm_authenticate()`
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1233517 https://bugzilla.suse.com/show_bug.cgi?id=1233517#c25 --- Comment #25 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-SU-2025:0192-1: An update that solves one vulnerability can now be installed. URL: https://www.suse.com/support/update/announcement/2025/suse-su-20250192-1 Category: security (important) Bug References: 1233517 CVE References: CVE-2025-23013 Maintenance Incident: [SUSE:Maintenance:37089](https://smelt.suse.de/incident/37089/) Sources used: SUSE Enterprise Storage 7.1 (src): pam_u2f-1.0.8-150000.3.6.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): pam_u2f-1.0.8-150000.3.6.1 SUSE Linux Enterprise Server 15 SP3 LTSS (src): pam_u2f-1.0.8-150000.3.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): pam_u2f-1.0.8-150000.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1236035] New: Tracker Bug: FDE Bypass
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1236035 Bug ID: 1236035 Summary: Tracker Bug: FDE Bypass Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: rbrown(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Tracking addressing FDE config issues related to https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1236055] New: An attacker can access data of any TPM-backed encrypted system
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1236055 Bug ID: 1236055 Summary: An attacker can access data of any TPM-backed encrypted system Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: dylan+suse(a)jmrt.be QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Build Identifier: By overwriting the system partition (LUKS encrypted) by a partition containing its own system, an attacker can trick the boot environment to boot its own system without being detected by the PCR involved in the pcrlock policy. Also, no PCR barrier set to prevent unsealing of the TPM secret once past the boot environement. As a consequence, once the machine has booted the rogue system, the PCR state still matches the values allowed in the pcrlock policy. The attacker can log into his rogue system (which he knows the root password for) and recover the secret from the TPM to then manually unlock the attacked system's partition. Reproducible: Always Steps to Reproduce: 1. The attacker gets hands on a machine running OpenSUSE Aeon with TPM-backed FDE, The recovery key or user credentials are unknown from the attacker. 2. The attacker prepares his Aeon installation. The attacker knows the recovery key and the root password for this installation. The attacker's root partition should be smaller than the targeted system's one. 3. The attacker clones the drive of the target machine 4a. The UUID of the EFI partition is different between both Aeon installations. The attacker updates the fstab of his system (which is found in /var overlays) to match the UUID of the targeted system. 4b. The attacker overwrites the root partition of the targeted system with his root partition. 5. The attacker boots the targeted system and when prompted, he writes the recovery key for his system. The targeted system should successfully boot the attacker's system 6. The attacker log in to his system with his credentials. From there, it can observe that the current PCR state (e.g. using "systemd-analyze pcrs") matches those found in the signed pcrlock file. 7. The attacker attaches the cloned drive containing the origianl targeted system and he can unlock it with systemd-cryptsetup, and access any data. Actual Results: After booting a rogue system, PCR values matches those in the signed pcrlock file. Expected Results: After booting a rogue system, or after leaving the initramfs, PCR values should not match those in the signed pcrlock file. Different solutions can be proposed: 1. Lock the LUKS secret with an additional PCR that is extended at different boot phases, as made possible with systemd-pcrextend and systemd-pcrlock (see --location option) 2. Design the boot environment to perform additional check after mounting the root filesystem, and before switching root. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1234775] [Build 20241220] openQA test fails in start_install
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234775 https://bugzilla.suse.com/show_bug.cgi?id=1234775#c9 --- Comment #9 from Stefan Hundhammer <shundhammer(a)suse.com> --- https://openqa.opensuse.org/tests/4723062/file/vars.json "QEMURAM" : 1024, ... "VNC" : "116", -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1236107] New: py2pack: AttributeError: 'NoneType' object has no attribute 'append'
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1236107 Bug ID: 1236107 Summary: py2pack: AttributeError: 'NoneType' object has no attribute 'append' Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: daniel.garcia(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Reported in github: https://github.com/openSUSE/py2pack/issues/212 py2pack generate kifield -f python-kifield.spec generating spec file for kifield... Traceback (most recent call last): File "/usr/bin/py2pack", line 10, in sys.exit(main()) File "/usr/lib/python3.6/site-packages/py2pack/init.py", line 365, in main args.func(args) File "/usr/lib/python3.6/site-packages/py2pack/init.py", line 254, in generate _augment_data_from_tarball(args, tarball_file[0], data) File "/usr/lib/python3.6/site-packages/py2pack/init.py", line 178, in _augment_data_from_tarball data["license_files"].append(_quote_shell_metacharacters(match_license.group(1))) AttributeError: 'NoneType' object has no attribute 'append' py2pack 0.8.6 python3-py2pack-0.8.6-bp156.3.1.noarch -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228797] New: python3-schema and python3-daemon not available with sle-module-pythons
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1228797 Bug ID: 1228797 Summary: python3-schema and python3-daemon not available with sle-module-pythons Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: egotthold(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I am attempting to build cobbler-tftp here [1]. This is failing due to two dependencies not being enabled for sle-module-pythons. I would desire that sle15allpythons is used so the package builds for both 3.6 and 3.11. Both versions in Leap are available at the moment with 3.6 and are compatible with it. [1]: https://build.opensuse.org/package/show/systemsmanagement:cobbler:release34… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1234775] [Build 20241220] openQA test fails in start_install
by bugzilla_noreply＠suse.com 20 Jan '25

20 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234775 https://bugzilla.suse.com/show_bug.cgi?id=1234775#c8 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(dimstar@opensuse. | |org) | --- Comment #8 from Stefan Hundhammer <shundhammer(a)suse.com> --- So what we have here is a YaST Qt UI installation with only 1 GB RAM. This is known to be problematic; there is a section in the SLE manuals explaining all the restrictions that apply in such a low-RAM scenario, including using the YaST NCurses UI to save the RAM needed for an X server and all the shared libs that the Qt UI needs. The promise to be able to install with only 1 GB RAM has been borderline realistic for several releases now; all kinds of system components tend to grow with their RAM requirements, and it's always the installation which sits at the end of the food chain where the accumulated increases of RAM usage become obvious by something crashing because of OOM. It might have worked before, but probably just barely, and that time might now be over. -- You are receiving this mail because: You are on the CC list for the bug.

1 0