- openSUSE Bugs

[Bug 1234688] New: VUL-0: CVE-2024-54662: dante: incorrect access control for some sockd.conf configurations
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234688 Bug ID: 1234688 Summary: VUL-0: CVE-2024-54662: dante: incorrect access control for some sockd.conf configurations Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/433220/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-54662 https://www.cve.org/CVERecord?id=CVE-2024-54662 https://www.inet.no/dante/ https://www.inet.no/dante/advisory-2024-12-16.txt https://bugzilla.redhat.com/show_bug.cgi?id=2332886 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1231408] VUL-0: CVE-2024-25885: python-xhtml2pdf: regular expression denial of service through the getColor() function in utils.py
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1231408 https://bugzilla.suse.com/show_bug.cgi?id=1231408#c7 --- Comment #7 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1231408) was mentioned in https://build.opensuse.org/request/show/1231847 Backports:SLE-15-SP6 / python-xhtml2pdf https://build.opensuse.org/request/show/1231848 Backports:SLE-15-SP5 / python-xhtml2pdf -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231408] New: VUL-0: CVE-2024-25885: python-xhtml2pdf: regular expression denial of service through the getcolor function in utils.py
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1231408 Bug ID: 1231408 Summary: VUL-0: CVE-2024-25885: python-xhtml2pdf: regular expression denial of service through the getcolor function in utils.py Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/423265/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-25885 https://www.cve.org/CVERecord?id=CVE-2024-25885 http://dirk.com http://xhtml2pdf.com https://gist.github.com/salvatore-abello/c88dd0027496774023ef36c7b576d206 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1234277] New: sysuser-tools: sysuser-shadow dependency on systemd introduces a dependency cycle
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234277 Bug ID: 1234277 Summary: sysuser-tools: sysuser-shadow dependency on systemd introduces a dependency cycle Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: daan.j.demeyer(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The cycle is as follows: sysuser-shadow => systemd => dbus-1 => dbus-1-common => sysuser-shadow This leads to the following installation failures when systemd and sysuser-shadow and a bunch of other packages are all installed in the same transaction: ``` Installing : dbus-1-1.14.10-4.1.x86_64 189/236 warning: group messagebus does not exist - using root Running scriptlet: dbus-1-1.14.10-4.1.x86_64 189/236 Running scriptlet: dbus-1-common-1.14.10-4.1.noarch 190/236 /var/tmp/rpm-tmp.OhJTQf: line 6: /usr/sbin/sysusers2shadow: No such file or directory error: %prein(dbus-1-common-1.14.10-4.1.noarch) scriptlet failed, exit status 127 Error in PREIN scriptlet in rpm package dbus-1-common Running scriptlet: system-group-hardware-20170617-26.1.noarch 191/236 error: dbus-1-common-1.14.10-4.1.noarch: install failed /var/tmp/rpm-tmp.Pi8y6T: line 1: /usr/sbin/sysusers2shadow: No such file or directory error: %prein(system-group-hardware-20170617-26.1.noarch) scriptlet failed, exit status 127 Error in PREIN scriptlet in rpm package system-group-hardware Running scriptlet: system-group-kvm-20170617-26.1.noarch 192/236 error: system-group-hardware-20170617-26.1.noarch: install failed /var/tmp/rpm-tmp.bFeS3I: line 1: /usr/sbin/sysusers2shadow: No such file or directory error: %prein(system-group-kvm-20170617-26.1.noarch) scriptlet failed, exit status 127 Error in PREIN scriptlet in rpm package system-group-kvm Running scriptlet: system-user-lp-20170617-26.1.noarch 193/236 error: system-group-kvm-20170617-26.1.noarch: install failed /var/tmp/rpm-tmp.FVYtWI: line 1: /usr/sbin/sysusers2shadow: No such file or directory error: %prein(system-user-lp-20170617-26.1.noarch) scriptlet failed, exit status 127 Error in PREIN scriptlet in rpm package system-user-lp Installing : sysuser-shadow-3.3-6.1.noarch ``` It seems to me that sysuser-shadow cannot have a dependency on systemd. Either systemd needs to subpackage systemd-sysusers or the dependency on systemd should be dropped. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1234684] New: Leap Micro 6.1 is broken and it cannot boot up for installation
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234684 Bug ID: 1234684 Summary: Leap Micro 6.1 is broken and it cannot boot up for installation Classification: openSUSE Product: openSUSE Leap Micro Version: 6.0 Hardware: aarch64 OS: openSUSE Leap 15.5 Status: NEW Severity: Major Priority: P5 - None Component: Installation Assignee: lubos.kocman(a)suse.com Reporter: zluo(a)suse.com QA Contact: jalausuch(a)suse.com Target Milestone: --- Found By: --- Blocker: --- We have now issue on openQA: https://openqa.opensuse.org/tests/4697404#step/disk_boot/5 And I verified this issue by using openSUSE-Leap-Micro.aarch64-6.1-Default-Build5.9.raw.xz No chance to get image to boot up for installation. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228075] Networkmanager: configure Hybrid bridge port and indefinite waiting connecting because slave interfaces are not coming up
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1228075 https://bugzilla.suse.com/show_bug.cgi?id=1228075#c7 --- Comment #7 from Diego Ercolani <diego.ercolani(a)gmail.com> --- Done, filled the same bug under kde plasma nm-applet: https://bugs.kde.org/show_bug.cgi?id=497644 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228868] New: Incorrect count of requests in `call_count`
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1228868 Bug ID: 1228868 Summary: Incorrect count of requests in `call_count` Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: ahasenkopf(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876481 --> https://bugzilla.suse.com/attachment.cgi?id=876481&action=edit Small script to reproduce the bug The `call_count` attribute of mocks differs from upstream packages. When using `urllib3.Retry` and using `responses` to mock a request, the resulting call count is wrong. With the attached example script, all Python versions and upstream packages from PyPI result in a call count of 7. On Leap 15.5 and Leap 15.6 the value is 11. Installed RPMs (excerpt): * python3-base-3.6.15-150300.10.65.1.x86_64 * libpython3_6m1_0-3.6.15-150300.10.65.1.x86_64 * python3-3.6.15-150300.10.65.2.x86_64 * python3-urllib3-1.25.10-150300.4.9.1.noarch * python3-requests-2.25.1-150300.3.6.1.noarch * python3-responses-0.21.0-150300.3.3.1.noarch Steps to reproduce: ``` docker run -it --rm registry.opensuse.org/opensuse/leap:15.6 zypper in python3-responses python3 <path-to-example-script> ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1234277] sysuser-tools: sysuser-shadow dependency on systemd introduces a dependency cycle
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234277 https://bugzilla.suse.com/show_bug.cgi?id=1234277#c3 --- Comment #3 from Michal Koutný <mkoutny(a)suse.com> --- FTR, I tried building systemd's mkosi image locally (i.e. with true zypper, not dnf like CI) and it fails too although via softhsm package: > (291/379) Installing: shadow-4.16.0-3.1.x86_64 .............................................................................................................................................[done] > Updating /etc/sysconfig/console ... > Updating /etc/sysconfig/keyboard ... > (292/379) Installing: kbd-2.6.4-5.1.x86_64 .................................................................................................................................................[done] > (293/379) Installing: update-bootloader-1.21-1.1.x86_64 ....................................................................................................................................[done] > /var/tmp/rpm-tmp.6XQA6w: line 1: /usr/sbin/sysusers2shadow: No such file or directory > error: %prein(softhsm-2.6.1+git.1732869438.f7883c2-1.1.x86_64) scriptlet failed, exit status 127 > error: softhsm-2.6.1+git.1732869438.f7883c2-1.1.x86_64: install failed > (294/379) Installing: softhsm-2.6.1+git.1732869438.f7883c2-1.1.x86_64 .....................................................................................................................[error] > Installation of softhsm-2.6.1+git.1732869438.f7883c2-1.1.x86_64 failed: > Error: Subprocess failed. Error: RPM failed: Command exited with status 1. I still wonder what caused they cycle unresolvability. I noticed a change to the initrd image definition [1] but that doesn't seem to have an effect in my case. (I know there's deps rework ongoing, so really sharing only for the reference.) [1] https://github.com/systemd/mkosi/commit/21d6298f0e8d6f21a6275a4acad7bc93e99… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1198453] Make %python_build and %pytest_arch parallel
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1198453 Martin Liška <martin.liska(a)hey.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|martin.liska(a)hey.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0