March 2025 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1239953] New: openscad -2021.01-7.2.x86_64 undefined symbol: __GLXEW_SGIX_fbconfig
by bugzilla_noreply＠suse.com 26 Apr '25

26 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1239953 Bug ID: 1239953 Summary: openscad -2021.01-7.2.x86_64 undefined symbol: __GLXEW_SGIX_fbconfig Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: ensonic(a)sonicpulse.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- ``` > sudo zypper in openscad [sudo] Passwort für root: Repository-Daten werden geladen... Installierte Pakete werden gelesen... Paketabhängigkeiten werden aufgelöst... Die folgenden 10 NEUEN Pakete werden installiert: libboost_program_options1_87_0 libboost_program_options1_87_0-x86-64-v3 libGLEW2_2 libopencsg1 libqscintilla2_qt5-15 libQt5Gamepad5 libqt5-qtgamepad-imports libspnav0 openscad qscintilla-qt5 10 neue Pakete zu installieren. Größe des Pakets zum Herunterladen: 4,9 MiB Änderung der Installationsgröße des Pakets: | 16,4 MiB erforderlich für Pakete, die installiert werden sollen 16,4 MiB | - 0 B freigegeben von Paketen, die entfernt werden sollen Backend: classic_rpmtrans Fortfahren? [j/n/v/...? zeigt alle Optionen] (j): j Abrufen: libGLEW2_2-2.2.0-7.2.x86_64 (Haupt-Repository (OSS)) (1/10), 188,9 KiB Abrufen: libGLEW2_2-2.2.0-7.2.x86_64.rpm ..........................................[fertig] Abrufen: libQt5Gamepad5-5.15.16+kde0-2.1.x86_64 (Haupt-Repository (OSS)) (2/10), 78,4 KiB Abrufen: libQt5Gamepad5-5.15.16+kde0-2.1.x86_64.rpm ..................[fertig (76,3 KiB/s)] Abrufen: libboost_program_options1_87_0-1.87.0-3.1.x86_64 (Haupt-Repository (OSS)) (3/10), 96,3 KiB Abrufen: libboost_program_options1_87_0-1.87.0-3.1.x86_64.rpm .....................[fertig] Abrufen: libopencsg1-1.6.0-2.6.x86_64 (Haupt-Repository (OSS)) (4/10), 77,3 KiB Abrufen: libopencsg1-1.6.0-2.6.x86_64.rpm .............................[fertig (1,0 KiB/s)] Abrufen: libqscintilla2_qt5-15-2.14.1-2.6.x86_64 (Haupt-Repository (OSS)) (5/10), 1002,8 KiB Abrufen: libqscintilla2_qt5-15-2.14.1-2.6.x86_64.rpm ..................[fertig (4,8 MiB/s)] Abrufen: qscintilla-qt5-2.14.1-2.6.x86_64 (Haupt-Repository (OSS)) (6/10), 194,4 KiB Abrufen: qscintilla-qt5-2.14.1-2.6.x86_64.rpm .....................................[fertig] Abrufen: libspnav0-1.1-1.6.x86_64 (Haupt-Repository (OSS)) (7/10), 30,6 KiB Abrufen: libspnav0-1.1-1.6.x86_64.rpm .............................................[fertig] Abrufen: libqt5-qtgamepad-imports-5.15.16+kde0-2.1.x86_64 (Haupt-Repository (OSS)) (8/10), 23,1 KiB Abrufen: libqt5-qtgamepad-imports-5.15.16+kde0-2.1.x86_64.rpm .....................[fertig] Abrufen: libboost_program_options1_87_0-x86-64-v3-1.87.0-3.1.x86_64 (Haupt-Repository (OSS)) (9/10), 96,9 KiB Abrufen: libboost_program_options1_87_0-x86-64-v3-1.87.0-3.1.x86_64.rpm ...........[fertig] Abrufen: openscad-2021.01-7.2.x86_64 (Haupt-Repository (OSS)) (10/10), 3,1 MiB Abrufen: openscad-2021.01-7.2.x86_64.rpm ..............................[fertig (9,6 MiB/s)] Überprüfung auf Dateikonflikte läuft: .............................................[fertig] ( 1/10) Installieren: libGLEW2_2-2.2.0-7.2.x86_64 .................................[fertig] ( 2/10) Installieren: libQt5Gamepad5-5.15.16+kde0-2.1.x86_64 ......................[fertig] ( 3/10) Installieren: libboost_program_options1_87_0-1.87.0-3.1.x86_64 ............[fertig] ( 4/10) Installieren: libopencsg1-1.6.0-2.6.x86_64 ................................[fertig] ( 5/10) Installieren: libqscintilla2_qt5-15-2.14.1-2.6.x86_64 .....................[fertig] ( 6/10) Installieren: qscintilla-qt5-2.14.1-2.6.x86_64 ............................[fertig] ( 7/10) Installieren: libspnav0-1.1-1.6.x86_64 ....................................[fertig] ( 8/10) Installieren: libqt5-qtgamepad-imports-5.15.16+kde0-2.1.x86_64 ............[fertig] ( 9/10) Installieren: libboost_program_options1_87_0-x86-64-v3-1.87.0-3.1.x86_64 ..[fertig] (10/10) Installieren: openscad-2021.01-7.2.x86_64 .................................[fertig] Nach-Transaktions-Skripte werden ausgeführt .......................................[fertig] > openscad --help openscad: symbol lookup error: openscad: undefined symbol: __GLXEW_SGIX_fbconfig > which openscad /usr/bin/openscad > rpm -qf /usr/bin/openscad openscad-2021.01-7.2.x86_64 ``` Upstream has no new releases: https://github.com/openscad/openscad/releases -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1239788] New: cmake4: build failure tracker bug.
by bugzilla_noreply＠suse.com 26 Apr '25

26 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1239788 Bug ID: 1239788 Summary: cmake4: build failure tracker bug. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: simonf.lees(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- A tracker bug to track all current cmake 4 related build failure bugx. The current status can be found in https://build.opensuse.org/project/show/home:simotek:cmake4 -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1232226] New: selinux-autorelabel tries to relabel btrfs partition containing ro snapshots, fails and leaves system in an unbootable state
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1232226 Bug ID: 1232226 Summary: selinux-autorelabel tries to relabel btrfs partition containing ro snapshots, fails and leaves system in an unbootable state Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: forgotten_u0-bnvADNc(a)user.net Reporter: registrations(a)wuthoehle.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I run MicroOS on my home server and have a btrfs partition mounted at /var/lib/data. The filesystem exclusively contains btrfs subvolumes which are mounted by various podman containers. These volumes are backed up regulary by btrbk (which is more-or-less a very convenient frontend to btrfs subvolume snapshot/btrfs send/btrfs receive). Accrodingly, there are always a few read-only snapshots inside /var/lib/data/snapshot. In the last few weeks, I experienced that the server wouldn't come up after an automatic reboot multiple times. It turns out that somehow something created a /etc/selinux/.autorelabel file (I guess that this was a byproduct of an update?), which leads to the system trying to relabel everything on the next boot. Unfortunately, when trying to relabel my /var/lib/data partition, restorecon fails when it arrives at the snapshots folder and quits with a "Read only file system" error. Even worse, this leads to a fail of the generated -relabel.service, local-fs.target and thus of the whole boot process. I had a quick look on the generator and it seems to have hardcoded a few paths which aren't supposed to be relabelled but unfortunately this doesn't seem to be configurable. Apparently volumes which have "noauto" set are ignored, too, but this doesn't help either as I want to have my services autostarted at boot time. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1236556] New: VUL-0: CVE-2024-45339: caddy: github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1236556 Bug ID: 1236556 Summary: VUL-0: CVE-2024-45339: caddy: github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/438660/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-45339:7.1:(AV:L/AC:L/PR:L/UI:N/ S:U/C:N/I:H/A:H) Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: emanuele.cappello(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1236540 Target Milestone: --- Found By: --- Blocker: --- When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45339 https://www.cve.org/CVERecord?id=CVE-2024-45339 https://github.com/golang/glog/pull/74 https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575… https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File https://pkg.go.dev/vuln/GO-2025-3372 https://bugzilla.redhat.com/show_bug.cgi?id=2342463 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1239425] New: VUL-0: CVE-2025-22869: caddy: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1239425 Bug ID: 1239425 Summary: VUL-0: CVE-2025-22869: caddy: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/442884/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H) Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1239322 Target Milestone: --- Found By: --- Blocker: --- SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22869 https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025… https://bugzilla.redhat.com/show_bug.cgi?id=2348367 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1239383] New: VUL-0: CVE-2025-22869: traefik: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1239383 Bug ID: 1239383 Summary: VUL-0: CVE-2025-22869: traefik: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/442884/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H) Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1239322 Target Milestone: --- Found By: --- Blocker: --- SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22869 https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025… https://bugzilla.redhat.com/show_bug.cgi?id=2348367 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1239233] New: VUL-0: CVE-2025-22868: traefik: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1239233 Bug ID: 1239233 Summary: VUL-0: CVE-2025-22868: traefik: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/442876/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2025-22868:7.5:(AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H) Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1239185 Target Milestone: --- Found By: --- Blocker: --- An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-22868 https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025… https://bugzilla.redhat.com/show_bug.cgi?id=2348366 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1237636] New: VUL-0: CVE-2025-27144: traefik: github.com/go-jose/go-jose/v4: Go JOSE's Parsing Vulnerable to Denial of Service
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1237636 Bug ID: 1237636 Summary: VUL-0: CVE-2025-27144: traefik: github.com/go-jose/go-jose/v4: Go JOSE's Parsing Vulnerable to Denial of Service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/441954/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2025-27144:7.5:(AV:N/AC:L/PR:N/UI:N/ S:U/C:N/I:N/A:H) Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: emanuele.cappello(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1237608 Target Milestone: --- Found By: --- Blocker: --- Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-27144 https://www.cve.org/CVERecord?id=CVE-2025-27144 https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0… https://github.com/go-jose/go-jose/releases/tag/v4.0.5 https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78 https://bugzilla.redhat.com/show_bug.cgi?id=2347423 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1234418] New: libhubbub debugging output degrades elinks usability
by bugzilla_noreply＠suse.com 25 Apr '25

25 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1234418 Bug ID: 1234418 Summary: libhubbub debugging output degrades elinks usability Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: post(a)jbechtel.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 879109 --> https://bugzilla.suse.com/attachment.cgi?id=879109&action=edit Elinks window for https://stackoverflow.com/questions/20994959/ The libhubbub debug prints make the use of some websites in elinks more difficult, see screenshot. More specifically, in treebuilder/treebuilder.c following code can be found which I suppose to be the reason for the outputs. Probably there's a macro NDEBUG missing in compilation: /* A slightly nasty debugging hook, but very useful */ #ifdef NDEBUG # define mode(x) \ case x: #else # define mode(x) \ case x: \ printf( #x "\n"); #endif while (err == HUBBUB_REPROCESS) { switch (treebuilder->context.mode) { mode(INITIAL) err = handle_initial(treebuilder, token); break; mode(BEFORE_HTML) err = handle_before_html(treebuilder, token); break; [...] mode(IN_BODY) err = handle_in_body(treebuilder, token); break; [...] -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1239761] New: Please create a new project "ultraviolet"
by bugzilla_noreply＠suse.com 24 Apr '25

24 Apr '25

https://bugzilla.suse.com/show_bug.cgi?id=1239761 Bug ID: 1239761 Summary: Please create a new project "ultraviolet" Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: BuildService Assignee: screening-team-bugs(a)suse.de Reporter: ddstreet(a)ieee.org QA Contact: adrian.schroeter(a)suse.com Target Milestone: --- Found By: --- Blocker: --- I'm part of the Microsoft LSG team, and we'd like to start a new project building fedora-based custom mkosi images, under a project named "ultraviolet", can you create that OBS project for us to use? -- You are receiving this mail because: You are on the CC list for the bug.

1 3