January 2025 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1235154] New: VUL-0: CVE-2025-21620: wasm-bindgen: deno: 'Authorization' header not dropped when fetch() handles cross-origin redirects
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235154 Bug ID: 1235154 Summary: VUL-0: CVE-2025-21620: wasm-bindgen: deno: 'Authorization' header not dropped when fetch() handles cross-origin redirects Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/435013/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: opensuse_buildservice(a)ojkastl.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1235152 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1235152 +++ Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno's fetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21620 https://www.cve.org/CVERecord?id=CVE-2025-21620 https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1234681] New: python-urllib3:test FTBFS in Tumbleweedl
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234681 Bug ID: 1234681 Summary: python-urllib3:test FTBFS in Tumbleweedl Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- python-urllib3:test has been failing since 12 or 13 December. This is a ring1 package so while it's broken, it might block other updates. The failures are: [ 34s] =========================== short test summary info ============================ [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_https_proxy - assert 500 == 200 [ 34s] + where 500 = <urllib3.response.HTTPResponse object at 0x7f8fd2e6a770>.status [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_https_proxy_with_proxy_ssl_context - assert 500 == 200 [ 34s] + where 500 = <urllib3.response.HTTPResponse object at 0x7f8fd838fbb0>.status [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_https_proxy_pyopenssl_not_supported - assert 500 == 200 [ 34s] + where 500 = <urllib3.response.HTTPResponse object at 0x7f8fd83d6cb0>.status [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_https_proxy_forwarding_for_https - assert 500 == 200 [ 34s] + where 500 = <urllib3.response.HTTPResponse object at 0x7f8fd8654a30>.status [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_https_headers_forwarding_for_https - json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_https_headers - json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_is_verified_https_proxy_to_http_target - assert 500 == 200 [ 34s] + where 500 = <urllib3.response.HTTPResponse object at 0x7fb34b776320>.status [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPProxyManager::test_http_and_https_kwarg_ca_cert_data_proxy - assert 500 == 200 [ 34s] + where 500 = <urllib3.response.HTTPResponse object at 0x7fb34bb60910>.status [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPSProxyVerification::test_https_proxy_ipv4_san - urllib3.exceptions.ProxySchemeUnsupported: TLS in TLS requires SSLContext.wrap_bio() which isn't available on non-native SSLContext [ 34s] FAILED test/with_dummyserver/test_proxy_poolmanager.py::TestHTTPSProxyVerification::test_https_proxy_ipv6_san - urllib3.exceptions.ProxySchemeUnsupported: TLS in TLS requires SSLContext.wrap_bio() which isn't available on non-native SSLContext [ 34s] ==== 10 failed, 1667 passed, 320 skipped, 4 xfailed, 114 warnings in 22.40s ==== See full log at: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Rings:1-… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1235153] New: VUL-0: CVE-2025-21620: deno: deno: 'Authorization' header not dropped when fetch() handles cross-origin redirects
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235153 Bug ID: 1235153 Summary: VUL-0: CVE-2025-21620: deno: deno: 'Authorization' header not dropped when fetch() handles cross-origin redirects Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/435013/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: aavindraa(a)gmail.com, camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1235152 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1235152 +++ Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno's fetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21620 https://www.cve.org/CVERecord?id=CVE-2025-21620 https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1235089] NVIDIA kernel module fails to build (nvidia-gfxG04-kmp-default-390.157_k6.11.8_1-48.26.x86_64.rpm)
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235089 https://bugzilla.suse.com/show_bug.cgi?id=1235089#c1 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Assignee|kernel-bugs(a)suse.de |sndirsch(a)suse.com Resolution|--- |FIXED QA Contact|qa-bugs(a)suse.de |sndirsch(a)suse.com Priority|P5 - None |P3 - Medium Component|Kernel:Drivers |X11 3rd Party Driver --- Comment #1 from Stefan Dirsch <sndirsch(a)suse.com> --- Package update is already triggered. Should be available in the next few days. ------------------------------------------------------------------- Sat Dec 28 12:41:38 UTC 2024 - Stefan Dirsch <sndirsch(a)suse.com> - kernel-6.12.patch * buildfix against Kernel 6.12 picked up from https://aur.archlinux.org/nvidia-390xx-utils.git/ -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234584] VUL-0: CVE-2024-45337: cheat: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234584 https://bugzilla.suse.com/show_bug.cgi?id=1234584#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1234584) was mentioned in https://build.opensuse.org/request/show/1235550 Backports:SLE-15-SP6 / cheat -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1235099] New: yast fails to build with ruby-3.4
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235099 Bug ID: 1235099 Summary: yast fails to build with ruby-3.4 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: mvidner(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- As usual, new Ruby was released on 2024-12-25, and some of the changes break the packages maintained by our team. This is a tracker bug for that -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1235089] NVIDIA kernel module fails to build (nvidia-gfxG04-kmp-default-390.157_k6.11.8_1-48.26.x86_64.rpm)
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235089 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sndirsch(a)suse.com, | |tiwai(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1235144] New: spack: records number of build machine cores
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235144 Bug ID: 1235144 Summary: spack: records number of build machine cores Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: eich(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our spack package varies from the number of build machine cores. To reproduce, you can use for N in 1 4 ; do osc build -M=doc --release=1.1 --noservice --clean \ --vm-type=kvm -j$N --keep-pkg=RPMS.$N openSUSE_Tumbleweed done md5sum RPMS.*/spack-man-0.23.0-1.1.noarch.rpm /usr/lib/build/pkg-diff.sh -a RPMS.{1,4}/spack-man-0.23.0-1.1.noarch.rpm The diff for /usr/share/man/man1/spack.1 is -.B spack.config.CONFIG_DEFAULTS = {\(aqconfig\(aq: {\(aqbuild_jobs\(aq: 4, \(aqbuild_stage\(aq: \(aq$tempdir/spack\-stage\(aq, \(aqchecksum\(aq: True, \(aqconnect_timeout\(aq: 10, \(aqdebug\(aq: False, \(aqdirty\(aq: False, \(aqlicense_dir\(aq: \(aq/home/abuild/rpmbuild/BUILD/spack\-0.23.0/etc/spack/licenses\(aq, \(aqverify_ssl\(aq: True}} +.B spack.config.CONFIG_DEFAULTS = {\(aqconfig\(aq: {\(aqbuild_jobs\(aq: 1, \(aqbuild_stage\(aq: \(aq$tempdir/spack\-stage\(aq, \(aqchecksum\(aq: True, \(aqconnect_timeout\(aq: 10, \(aqdebug\(aq: False, \(aqdirty\(aq: False, \(aqlicense_dir\(aq: \(aq/home/abuild/rpmbuild/BUILD/spack\-0.23.0/etc/spack/licenses\(aq, \(aqverify_ssl\(aq: True}} ... @@ -71561,7 +71561,7 @@ .UNINDENT .INDENT 0.0 .TP -.B spack.config.determine_number_of_jobs(*, parallel: \X'tty: link https://docs.python.org/3/library/functions.html#bool'\fI\%bool\fP\X'tty: link' = False, max_cpus: \X'tty: link https://docs.python.org/3/library/functions.html#int'\fI\%int\fP\X'tty: link' = 4, config: \fI\%Configuration\fP | \X'tty: link https://docs.python.org/3/library/constants.html#None'\fI\%None\fP\X'tty: link' = None) -> \X'tty: link https://docs.python.org/3/library/functions.html#int'\fI\%int\fP\X'tty: link' +.B spack.config.determine_number_of_jobs(*, parallel: \X'tty: link https://docs.python.org/3/library/functions.html#bool'\fI\%bool\fP\X'tty: link' = False, max_cpus: \X'tty: link https://docs.python.org/3/library/functions.html#int'\fI\%int\fP\X'tty: link' = 1, config: \fI\%Configuration\fP | \X'tty: link https://docs.python.org/3/library/constants.html#None'\fI\%None\fP\X'tty: link' = None) -> \X'tty: link https://docs.python.org/3/library/functions.html#int'\fI\%int\fP\X'tty: link' Packages that require sequential builds need 1 job. Otherwise we use the my 2y old notes say, the output is produced by makeinfo --no-split -o 'Spack.info' 'Spack.texi' and the input Spack.texi already varies. https://github.com/spack/spack/pull/36064 and https://github.com/spack/spack/pull/20629 had an old patch. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234904] openQA tests failing with systemd 257.1
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234904 https://bugzilla.suse.com/show_bug.cgi?id=1234904#c1 --- Comment #1 from Thorsten Kukuk <kukuk(a)suse.com> --- (In reply to Ana Guerrero from comment #0) > Job for nginx.service failed because the control process exited with error > code. > See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for > details. > aeoQx-1- nginx user gets created according to the logs, but is not available. Since nscd is running and systemd 257 has dropped nscd support, we need to kill nscd here. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203308] Astroprojection cursor after opening the steam client.
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1203308 https://bugzilla.suse.com/show_bug.cgi?id=1203308#c7 Rylee K <adamska156(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |adamska156(a)gmail.com --- Comment #7 from Rylee K <adamska156(a)gmail.com> --- It's been over 2 years and there's not been a single reply to this bug report, meanwhile most other major distros have already merged this libei patch into xwayland. Is there any chance this will ever happen with Tumbleweed? -- You are receiving this mail because: You are on the CC list for the bug.

1 0