--17337381641.D3A89033.11
Date: Mon, 9 Dec 2024 09:56:04 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234308

            Bug ID: 1234308
           Summary: dracut (yast2 inline_update) fails silently when /boot is full
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: x86-64
                OS: openSUSE Leap 15.5
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: Ulrich.Windl-at-rz.uni-regensburg.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I updated the system when the initrd had to be rebuilt.
After "successful" completion there was a GNOME popup that /boot only has 1=
5kB
free space left, so I checked the journal for errors.
As I didn't find any, I rebooted the system.
Before I had run a snapper cleanup to free 15% in /boot.

On reboot the system paniced, because the initrd was missing or invalid.
Same happened when I tried to boot an older kernel (obviously because all
initrd were rebuilt and thus damaged).

So I had to use a rescue system and a chroot environment to rebuild the
initrds.

The messages in pbl.log were:
hroot)
2024-12-09 10:32:22 <1> update-bootloader-2511 main.312:
/sbin/update-bootloader --refresh
2024-12-09 10:32:22 <1> update-bootloader-2511 main.314: bootloader =3D gru=
b2-efi
2024-12-09 10:32:22 <1> update-bootloader-2511 main.320: locale =3D=20
2024-12-09 10:32:29 <1> update-bootloader-2511 run_command.338:
'/usr/lib/bootloader/grub2-efi/config' =3D 0, output:
<<<<<<<<<<<<<<<<
+ /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
Generating grub configuration file ...
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
Found theme: /boot/grub2/themes/openSUSE/theme.txt
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
Found linux image: /boot/vmlinuz-6.4.0-150600.23.25-default
Found initrd image: /boot/initrd-6.4.0-150600.23.25-default
-----
There were no error messages in the journal.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17337381641.D3A89033.11
Date: Mon, 9 Dec 2024 09:56:04 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234308

          Summary
          dracut (yast2 inline_update) fails silently when /boot is full

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          x86-64

          OS
          openSUSE Leap 15.5

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          Ulrich.Windl@rz.uni-regensburg.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I updated the system when the initrd had to be rebuilt.
After "successful" completion there was a GNOME popup that /boot =
only has 15kB
free space left, so I checked the journal for errors.
As I didn't find any, I rebooted the system.
Before I had run a snapper cleanup to free 15% in /boot.

On reboot the system paniced, because the initrd was missing or invalid.
Same happened when I tried to boot an older kernel (obviously because all
initrd were rebuilt and thus damaged).

So I had to use a rescue system and a chroot environment to rebuild the
initrds.

The messages in pbl.log were:
hroot)
2024-12-09 10:32:22 <1> update-bootloader-2511 main.312:
/sbin/update-bootloader --refresh
2024-12-09 10:32:22 <1> update-bootloader-2511 main.314: bootloader =
=3D grub2-efi
2024-12-09 10:32:22 <1> update-bootloader-2511 main.320: locale =3D=20
2024-12-09 10:32:29 <1> update-bootloader-2511 run_command.338:
'/usr/lib/bootloader/grub2-efi/config' =3D 0, output:
<<<<<<<<<<<<<<<<
+ /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
Generating grub configuration file ...
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
Found theme: /boot/grub2/themes/openSUSE/theme.txt
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
  WARNING: failed to init udev for external device info, using none.
Found linux image: /boot/vmlinuz-6.4.0-150600.23.25-default
Found initrd image: /boot/initrd-6.4.0-150600.23.25-default
-----
There were no error messages in the journal.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17337381641.D3A89033.11--


--17337447173.11bD552d.56
Date: Mon, 9 Dec 2024 11:45:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234314

            Bug ID: 1234314
           Summary: [Build 20241208] SELinux: openQA test fails in audit2allow
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4692625/modules/audi
                    t2allow/steps/48
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

>From the terminal, this seems to be this error:
Checking for file conflicts: [...done]
(1/2) Installing: python311-distro-1.9.0-2.3.noarch [..
error: setexecfilecon: (/bin/sh, rpm_script_t) Invalid argument
error: Plugin selinux: hook scriplet_fork_post failed
warning: %post(python311-distro-1.9.0-2.3.noarch) scriptlet failed, exit st=
atus
126
done]
(2/2) Installing: policycoreutils-devel-3.7-1.3.x86_64 [..done]
Running post-transaction scripts [....done]
TpLaZ-107-
Not sure what to look for in the audit log )invalid argument seems not to b=
e a
denied message, is it?)
The scriptlet of python311-distro does not do much :
> rpm -q --scripts python311-distro
postinstall scriptlet (using /bin/sh):
# python311_install_alternative:=20
update-alternatives --quiet --install /usr/bin/distro distro
/usr/bin/distro-3.11 1311

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-selinux@64bit fails =
in
[audit2allow](https://openqa.opensuse.org/tests/4692625/modules/audit2allow=
/steps/48)

## Test suite description
Maintainer (Lily Zhao) llzhao-at-suse.com

## Reproducible

Fails since (at least) Build
[20241204](https://openqa.opensuse.org/tests/4684005)

## Expected result

Last good: [20241203](https://openqa.opensuse.org/tests/4682286) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dselinux&version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17337447173.11bD552d.56
Date: Mon, 9 Dec 2024 11:45:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234314

          Summary
          [Build 20241208] SELinux: openQA test fails in audit2allow

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4692625/modules/audit2allow=
/steps/48

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

>From the terminal, this seems to be this error:
Checking for file conflicts: [...done]
(1/2) Installing: python311-distro-1.9.0-2.3.noarch [..
error: setexecfilecon: (/bin/sh, rpm_script_t) Invalid argument
error: Plugin selinux: hook scriplet_fork_post failed
warning: %post(python311-distro-1.9.0-2.3.noarch) scriptlet failed, exit st=
atus
126
done]
(2/2) Installing: policycoreutils-devel-3.7-1.3.x86_64 [..done]
Running post-transaction scripts [....done]
TpLaZ-107-
Not sure what to look for in the audit log )invalid argument seems not to b=
e a
denied message, is it?)
The scriptlet of python311-distro does not do much :
> rpm -q --scripts python311-distro
postinstall scriptlet (using /bin/sh):
# python311_install_alternative:=20
update-alternatives --quiet --install /usr/bin/distro distro
/usr/bin/distro-3.11 1311

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-selinux@64bit fa=
ils in
[audit2allow](https://openqa.opensuse.org/tests/4692625/modules/aud=
it2allow/steps/48)

## Test suite description
Maintainer (Lily Zhao) llzhao@su=
se.com

## Reproducible

Fails since (at least) Build
[20241204](https://op=
enqa.opensuse.org/tests/4684005)

## Expected result

Last good: [20241203](https://openqa.opensuse.org/tests/4682286) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=
=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D64bit&te=
st=3Dselinux&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17337447173.11bD552d.56--


--17338742480.6BD03.194
Date: Tue, 10 Dec 2024 23:44:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234361

            Bug ID: 1234361
           Summary: VUL-0: chromium: 131.0.6778.139 stable release
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: ro-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-des=
ktop_10.html

Fix in Chromium 131.0.6778.139=20

* CVE-2024-12381: Type Confusion in V8
* CVE-2024-12382: Use after free in Translate
* Various fixes from internal audits, fuzzing and other initiatives
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17338742480.6BD03.194
Date: Tue, 10 Dec 2024 23:44:08 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234361

          Summary
          VUL-0: chromium: 131.0.6778.139 stable release

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          ro@suse.com

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2024/12/stable-channel-update-for-desktop_10.html

Fix in Chromium 131.0.6778.139=20

* CVE-2024-12381: Type Confusion in V8
* CVE-2024-12382: Use after free in Translate
* Various fixes from internal audits, fuzzing and other initiatives

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17338742480.6BD03.194--


body:
--17339899726.cF4bB.65
Date: Thu, 12 Dec 2024 07:52:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234406

            Bug ID: 1234406
           Summary: bind package root.hints outdated
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: patrick.schaaf-at-yalwa.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Package bind-9.20.3-1.1.x86_64, current as of tumbleweed 20241210, contains=
 an
outdated root.hints file.

Canonical source is https://www.internic.net/domain/named.root and has for
b.root-servers.net

> ;       last update:     November 20, 2024
> B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
> B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b

Packaged file has

> ;       last update:     July 28, 2021
> B.ROOT-SERVERS.NET.      3600000      A     199.9.14.201
> B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:200::b

I noticed this because apparently bind has a builtin list, and using that, =
puts
this warning into syslog:

Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A
(170.247.170.2) missing from hints
Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A
(199.9.14.201) extra record in hints
Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA
(2801:1b8:10::b) missing from hints
Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA
(2001:500:200::b) extra record in hints
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17339899726.cF4bB.65
Date: Thu, 12 Dec 2024 07:52:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234406

          Summary
          bind package root.hints outdated

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Network

          Assignee
          screening-team-bugs@suse.de

          Reporter
          patrick.schaaf@yalwa.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Package bind-9.20.3-1.1.x86_64, current as of tumbleweed 202=
41210, contains an
outdated root.hints file.

Canonical source is =
https://www.internic.net/domain/named.root and has for
b.root-servers.net

> ;       last update:     November 20, 2024
> B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
> B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b

Packaged file has

> ;       last update:     July 28, 2021
> B.ROOT-SERVERS.NET.      3600000      A     199.9.14.201
> B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:200::b

I noticed this because apparently bind has a builtin list, and using that, =
puts
this warning into syslog:

Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A
(170.247.170.2) missing from hints
Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/A
(199.9.14.201) extra record in hints
Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA
(2801:1b8:10::b) missing from hints
Dec 12 08:33:01 track named[616754]: checkhints: b.root-servers.net/AAAA
(2001:500:200::b) extra record in hints

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17339899726.cF4bB.65--

summary: bind package root.hints outdated


body:
--17340049393.CB4E.533
Date: Thu, 12 Dec 2024 12:02:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234430

            Bug ID: 1234430
           Summary: libzypp fails to build with boost 1.87
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: libzypp
          Assignee: zypp-maintainers-at-suse.de
          Reporter: aschnell-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

libzypp fails to build with boost 1.87. Details can be seen at

https://build.opensuse.org/project/show/home:aschnell:boost2
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340049393.CB4E.533
Date: Thu, 12 Dec 2024 12:02:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234430

          Summary
          libzypp fails to build with boost 1.87

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          libzypp

          Assignee
          zypp-maintainers@suse.de

          Reporter
          aschnell@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

libzypp fails to build with boost 1.87. Details can be seen =
at

ht=
tps://build.opensuse.org/project/show/home:aschnell:boost2

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340049393.CB4E.533--

summary: libzypp fails to build with boost 1.87


body:
--17340073761.102970DFd.635
Date: Thu, 12 Dec 2024 12:42:56 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234438

            Bug ID: 1234438
           Summary: virt-manager fails to create new images
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: aplanas-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Creating new images via virt-manager, throws this error after pressing the
"Begin Installation" button:

```
Unable to complete install: 'End of file while reading data: Input/output
error'

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 71, in
cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/createvm.py", line 2085, in
_do_async_install
    installer.start_install(guest, meter=3Dmeter)
  File "/usr/share/virt-manager/virtinst/install/installer.py", line 768, in
start_install
    domain =3D self._create_guest(
             ^^^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtinst/install/installer.py", line 709, in
_create_guest
    domain =3D self.conn.createXML(initial_xml or final_xml, 0)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/site-packages/libvirt.py", line 4545, in
createXML
    raise libvirtError('virDomainCreateXML() failed')
libvirt.libvirtError: End of file while reading data: Input/output error
```

Versions:
  virt-manager-common-5.0.0-2.1.noarch
  virt-manager-5.0.0-2.1.noarch
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340073761.102970DFd.635
Date: Thu, 12 Dec 2024 12:42:56 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234438

          Summary
          virt-manager fails to create new images

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Tools

          Assignee
          virt-bugs@suse.de

          Reporter
          aplanas@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Creating new images via virt-manager, throws this error afte=
r pressing the
"Begin Installation" button:

```
Unable to complete install: 'End of file while reading data: Input/output
error'

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 71=
, in
cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/createvm.py", line 20=
85, in
_do_async_install
    installer.start_install(guest, meter=3Dmeter)
  File "/usr/share/virt-manager/virtinst/install/installer.py", l=
ine 768, in
start_install
    domain =3D self._create_guest(
             ^^^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtinst/install/installer.py", l=
ine 709, in
_create_guest
    domain =3D self.conn.createXML(initial_xml or final_xml, 0)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/site-packages/libvirt.py", line 454=
5, in
createXML
    raise libvirtError('virDomainCreateXML() failed')
libvirt.libvirtError: End of file while reading data: Input/output error
```

Versions:
  virt-manager-common-5.0.0-2.1.noarch
  virt-manager-5.0.0-2.1.noarch

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340073761.102970DFd.635--

summary: virt-manager fails to create new images


--17340158032.a9fbf7.1364
Date: Thu, 12 Dec 2024 15:03:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234445

            Bug ID: 1234445
           Summary: Cannot static link against libelf 0.192-1.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: doreilly-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Building velociraptor with libelf-devel 0.192-1.1 fails with:

exec: go "build" "-o" "output/velociraptor-v0.7.0-4-linux-amd64" "-tags" "
server_vql extras  release yara disable_gui  linuxbpf libbpfgo_static "
"-ldflags=3D-s -w  -X
\"www.velocidex.com/golang/velociraptor/config.build_time=3D2024-12-12T11:4=
5:42Z\"
-X \"www.velocidex.com/golang/velociraptor/config.commit_hash=3D27cfbe1d\""
"./bin/"
# www.velocidex.com/golang/velociraptor/bin
/usr/lib64/go/1.22/pkg/tool/linux_amd64/link: running gcc failed: exit stat=
us 1
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../x86_64-suse-linux/bin/ld:
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../lib64/libelf.a(elf_begin.o)=
: in
function `file_read_elf':
/home/abuild/rpmbuild/BUILD/elfutils-0.192/libelf/elf_begin.c:540:(.text+0x=
3a9):
undefined reference to `eu_search_tree_init'
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../x86_64-suse-linux/bin/ld:
/home/abuild/rpmbuild/BUILD/elfutils-0.192/libelf/elf_begin.c:540:(.text+0x=
529):
undefined reference to `eu_search_tree_init'
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../x86_64-suse-linux/bin/ld:
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../lib64/libelf.a(elf_end.o): =
in
function `elf_end':
/home/abuild/rpmbuild/BUILD/elfutils-0.192/libelf/elf_end.c:136:(.text+0xb0=
):
undefined reference to `eu_search_tree_fini'
collect2: error: ld returned 1 exit status

Seems to be fixed in libelf upstream=20=20
https://sourceware.org/bugzilla/show_bug.cgi?id=3D32293
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340158032.a9fbf7.1364
Date: Thu, 12 Dec 2024 15:03:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234445

          Summary
          Cannot static link against libelf 0.192-1.1

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          doreilly@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Building velociraptor with libelf-devel 0.192-1.1 fails with:

exec: go "build" "-o" "output/velociraptor-v0.7.0-=
4-linux-amd64" "-tags" "
server_vql extras  release yara disable_gui  linuxbpf libbpfgo_static "
"-ldflags=3D-s -w  -X
\"www.velocidex.com/golang/velociraptor/config.build_time=3D2024-12-12=
T11:45:42Z\"
-X \"www.velocidex.com/golang/velociraptor/config.commit_hash=3D27cfbe=
1d\""
"./bin/"
# www.velocidex.com/golang/velociraptor/bin
/usr/lib64/go/1.22/pkg/tool/linux_amd64/link: running gcc failed: exit stat=
us 1
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../x86_64-suse-linux/bin/ld:
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../lib64/libelf.a(elf_begin.o)=
: in
function `file_read_elf':
/home/abuild/rpmbuild/BUILD/elfutils-0.192/libelf/elf_begin.c:540:(.text+0x=
3a9):
undefined reference to `eu_search_tree_init'
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../x86_64-suse-linux/bin/ld:
/home/abuild/rpmbuild/BUILD/elfutils-0.192/libelf/elf_begin.c:540:(.text+0x=
529):
undefined reference to `eu_search_tree_init'
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../x86_64-suse-linux/bin/ld:
/usr/lib64/gcc/x86_64-suse-linux/14/../../../../lib64/libelf.a(elf_end.o): =
in
function `elf_end':
/home/abuild/rpmbuild/BUILD/elfutils-0.192/libelf/elf_end.c:136:(.text+0xb0=
):
undefined reference to `eu_search_tree_fini'
collect2: error: ld returned 1 exit status

Seems to be fixed in libelf upstream=20=20
https:/=
/sourceware.org/bugzilla/show_bug.cgi?id=3D32293

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340158032.a9fbf7.1364--


--17340173031.d8C27.1474
Date: Thu, 12 Dec 2024 15:28:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234454

            Bug ID: 1234454
           Summary: Compiling external modules fails with "/usr/src/linux-6.13.0-rc2-1.gf92fc5d/include/config/a uto.conf: No such file or directory"
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: avinesh.kumar-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

As part of LTP tests, we compile and test some external modules, for exampl=
e -
https://github.com/linux-test-project/ltp/tree/master/testcases/kernel/sysc=
alls/delete_module

Starting with Tumbleweed kotd version 6.13, building modules fails with -=20

Building modules: dummy_del_mod.c dummy_del_mod_dep.c
make -C /lib/modules/6.13.0-rc2-1.gf92fc5d-default/build
M=3D/root/ltp/testcases/kernel/syscalls/delete_module
make[1]: Entering directory
'/usr/src/linux-6.13.0-rc2-1.gf92fc5d-obj/x86_64/default'
/usr/src/linux-6.13.0-rc2-1.gf92fc5d/Makefile:782:
/usr/src/linux-6.13.0-rc2-1.gf92fc5d/include/config/auto.conf: No such file=
 or
directory
make[1]: *** [../../../linux-6.13.0-rc2-1.gf92fc5d/Makefile:251: __sub-make]
Error 2
make[1]: Leaving directory
'/usr/src/linux-6.13.0-rc2-1.gf92fc5d-obj/x86_64/default'
make: [../../../../include/mk/module.mk:62: .dep_modules] Error 2 (ignored)

openqa step for this -
https://openqa.opensuse.org/tests/4698291#step/install_ltp/116
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340173031.d8C27.1474
Date: Thu, 12 Dec 2024 15:28:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234454

          Summary
          Compiling external modules fails with "/usr/src/linux-6.=
13.0-rc2-1.gf92fc5d/include/config/auto.conf: No such file or directory&quo=
t;

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          avinesh.kumar@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

As part of LTP tests, we compile and test some external modu=
les, for example -
https://github.com/linux-test-project/ltp/tr=
ee/master/testcases/kernel/syscalls/delete_module

Starting with Tumbleweed kotd version 6.13, building modules fails with -=20

Building modules: dummy_del_mod.c dummy_del_mod_dep.c
make -C /lib/modules/6.13.0-rc2-1.gf92fc5d-default/build
M=3D/root/ltp/testcases/kernel/syscalls/delete_module
make[1]: Entering directory
'/usr/src/linux-6.13.0-rc2-1.gf92fc5d-obj/x86_64/default'
/usr/src/linux-6.13.0-rc2-1.gf92fc5d/Makefile:782:
/usr/src/linux-6.13.0-rc2-1.gf92fc5d/include/config/auto.conf: No such file=
 or
directory
make[1]: *** [../../../linux-6.13.0-rc2-1.gf92fc5d/Makefile:251: __sub-make]
Error 2
make[1]: Leaving directory
'/usr/src/linux-6.13.0-rc2-1.gf92fc5d-obj/x86_64/default'
make: [../../../../include/mk/module.mk:62: .dep_modules] Error 2 (ignored)

openqa step for this -
=
https://openqa.opensuse.org/tests/4698291#step/install_ltp/116

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340173031.d8C27.1474--


--173408759812.D89f.308
Date: Fri, 13 Dec 2024 10:59:58 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234528

            Bug ID: 1234528
           Summary: VUL-0: : minikube: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/432234/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234482
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifical=
ly,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.cve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb=
d8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024=
-45337.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--173408759812.D89f.308
Date: Fri, 13 Dec 2024 10:59:58 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234528

          Summary
          VUL-0: : minikube: golang.org/x/crypto/ssh: Misuse of ServerC=
onfig.PublicKeyCallback may cause authorization bypass in golang.org/x/cryp=
to

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/432234/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          gianluca.gabrielli@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234482

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Applications and libraries which misuse the ServerConfig.Pub=
licKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does=
 not
guarantee that the key offered is in fact used to authenticate." Speci=
fically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0=
.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec=
3e05d6bf3e90b695fbd8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJ=
CqdAQAJ
https://pkg.go.dev/vuln/GO=
-2024-3321
http://=
www.openwall.com/lists/oss-security/2024/12/11/2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/45xxx/CVE-2024-45337.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--173408759812.D89f.308--


--17340961971.dD75c.716
Date: Fri, 13 Dec 2024 13:23:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234565

            Bug ID: 1234565
           Summary: VUL-0: CVE-2024-45337: git-bug: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/432234/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/
                    S:U/C:H/I:H/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mcepl-at-suse.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234482
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifical=
ly,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.cve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb=
d8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024=
-45337.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340961971.dD75c.716
Date: Fri, 13 Dec 2024 13:23:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234565

          Summary
          VUL-0: CVE-2024-45337: git-bug: golang.org/x/crypto/ssh: Misu=
se of ServerConfig.PublicKeyCallback may cause authorization bypass in gola=
ng.org/x/crypto

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/432234/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/S:U/C:H=
/I:H/A:H)

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          mcepl@suse.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234482

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Applications and libraries which misuse the ServerConfig.Pub=
licKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does=
 not
guarantee that the key offered is in fact used to authenticate." Speci=
fically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0=
.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec=
3e05d6bf3e90b695fbd8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJ=
CqdAQAJ
https://pkg.go.dev/vuln/GO=
-2024-3321
http://=
www.openwall.com/lists/oss-security/2024/12/11/2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/45xxx/CVE-2024-45337.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340961971.dD75c.716--


--17340962105.0C4b74FD.716
Date: Fri, 13 Dec 2024 13:23:30 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234584

            Bug ID: 1234584
           Summary: VUL-0: CVE-2024-45337: cheat: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/432234/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/
                    S:U/C:H/I:H/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234482
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifical=
ly,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.cve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb=
d8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024=
-45337.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340962105.0C4b74FD.716
Date: Fri, 13 Dec 2024 13:23:30 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234584

          Summary
          VUL-0: CVE-2024-45337: cheat: golang.org/x/crypto/ssh: Misuse=
 of ServerConfig.PublicKeyCallback may cause authorization bypass in golang=
.org/x/crypto

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/432234/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/S:U/C:H=
/I:H/A:H)

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          mvetter@suse.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234482

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Applications and libraries which misuse the ServerConfig.Pub=
licKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does=
 not
guarantee that the key offered is in fact used to authenticate." Speci=
fically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0=
.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec=
3e05d6bf3e90b695fbd8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJ=
CqdAQAJ
https://pkg.go.dev/vuln/GO=
-2024-3321
http://=
www.openwall.com/lists/oss-security/2024/12/11/2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/45xxx/CVE-2024-45337.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340962105.0C4b74FD.716--


--17340962082.f553f.716
Date: Fri, 13 Dec 2024 13:23:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234582

            Bug ID: 1234582
           Summary: VUL-0: CVE-2024-45337: cloudflared: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/432234/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/
                    S:U/C:H/I:H/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: hillwoodroc-at-gmail.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234482
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifical=
ly,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.cve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb=
d8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024=
-45337.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340962082.f553f.716
Date: Fri, 13 Dec 2024 13:23:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234582

          Summary
          VUL-0: CVE-2024-45337: cloudflared: golang.org/x/crypto/ssh: =
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in =
golang.org/x/crypto

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/432234/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/S:U/C:H=
/I:H/A:H)

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          hillwoodroc@gmail.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234482

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Applications and libraries which misuse the ServerConfig.Pub=
licKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does=
 not
guarantee that the key offered is in fact used to authenticate." Speci=
fically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0=
.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec=
3e05d6bf3e90b695fbd8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJ=
CqdAQAJ
https://pkg.go.dev/vuln/GO=
-2024-3321
http://=
www.openwall.com/lists/oss-security/2024/12/11/2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/45xxx/CVE-2024-45337.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340962082.f553f.716--


--17340962167.d864CA5E.716
Date: Fri, 13 Dec 2024 13:23:36 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234598

            Bug ID: 1234598
           Summary: VUL-0: CVE-2024-45337: gitea-tea: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/432234/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/
                    S:U/C:H/I:H/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234482
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifical=
ly,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.cve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb=
d8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024=
-45337.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340962167.d864CA5E.716
Date: Fri, 13 Dec 2024 13:23:36 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234598

          Summary
          VUL-0: CVE-2024-45337: gitea-tea: golang.org/x/crypto/ssh: Mi=
suse of ServerConfig.PublicKeyCallback may cause authorization bypass in go=
lang.org/x/crypto

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/432234/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/S:U/C:H=
/I:H/A:H)

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234482

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Applications and libraries which misuse the ServerConfig.Pub=
licKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does=
 not
guarantee that the key offered is in fact used to authenticate." Speci=
fically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0=
.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec=
3e05d6bf3e90b695fbd8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJ=
CqdAQAJ
https://pkg.go.dev/vuln/GO=
-2024-3321
http://=
www.openwall.com/lists/oss-security/2024/12/11/2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/45xxx/CVE-2024-45337.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340962167.d864CA5E.716--


body:
--17340962018.D5e86aFfB.716
Date: Fri, 13 Dec 2024 13:23:21 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234574

            Bug ID: 1234574
           Summary: VUL-0: CVE-2024-45337: forgejo-runner,forgejo: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/432234/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/
                    S:U/C:H/I:H/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234482
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Applications and libraries which misuse the ServerConfig.PublicKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does not
guarantee that the key offered is in fact used to authenticate." Specifical=
ly,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.cve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fb=
d8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
https://pkg.go.dev/vuln/GO-2024-3321
http://www.openwall.com/lists/oss-security/2024/12/11/2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/45xxx/CVE-2024=
-45337.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17340962018.D5e86aFfB.716
Date: Fri, 13 Dec 2024 13:23:21 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234574

          Summary
          VUL-0: CVE-2024-45337: forgejo-runner,forgejo: golang.org/x/c=
rypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization=
 bypass in golang.org/x/crypto

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/432234/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-45337:8.1:(AV:N/AC:H/PR:N/UI:N/S:U/C:H=
/I:H/A:H)

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234482

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Applications and libraries which misuse the ServerConfig.Pub=
licKeyCallback
callback may be susceptible to an authorization bypass. The documentation f=
or
ServerConfig.PublicKeyCallback says that "A call to this function does=
 not
guarantee that the key offered is in fact used to authenticate." Speci=
fically,
the SSH protocol allows clients to inquire about whether a public key is
acceptable before proving control of the corresponding private key.
PublicKeyCallback may be called with multiple keys, and the order in which =
the
keys were provided cannot be used to infer which key the client successfully
authenticated with, if any. Some applications, which store the key(s) passe=
d to
PublicKeyCallback (or derived information) and make security relevant
determinations based on it once the connection is established, may make
incorrect assumptions. For example, an attacker may send public keys A and =
B,
and then authenticate with A. PublicKeyCallback would be called only twice,
first with A and then with B. A vulnerable application may then make
authorization decisions based on key B for which the attacker does not actu=
ally
control the private key. Since this API is widely misused, as a partial
mitigation golang.org/x/cry...@v0=
.31.0 enforces the property that, when
successfully authenticating via public key, the last key passed to
ServerConfig.PublicKeyCallback will be the key used to authenticate the
connection. PublicKeyCallback will now be called multiple times with the sa=
me
key, if necessary. Note that the client may still not control the last key
passed to PublicKeyCallback if the connection is then authenticated with a
different method, such as PasswordCallback, KeyboardInteractiveCallback, or
NoClientAuth. Users should be using the Extensions field of the Permissions
return value from the various authentication callbacks to record data
associated with the authentication attempt instead of referencing external
state. Once the connection is established the state corresponding to the
successful authentication attempt can be retrieved via the
ServerConn.Permissions field. Note that some third-party libraries misuse t=
he
Permissions type by sharing it across authentication attempts; users of
third-party libraries should refer to the relevant projects for guidance.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45337
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45337
https://github.com/golang/crypto/commit/b4f1988a35dee11ec=
3e05d6bf3e90b695fbd8909
https://go.dev/cl/635315
https://go.dev/issue/70779
https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJ=
CqdAQAJ
https://pkg.go.dev/vuln/GO=
-2024-3321
http://=
www.openwall.com/lists/oss-security/2024/12/11/2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2331720
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/45xxx/CVE-2024-45337.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17340962018.D5e86aFfB.716--

pkgs: forgejo forgejo-runner


body:
--17342165401.e7c55B.11
Date: Sat, 14 Dec 2024 22:49:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234618

            Bug ID: 1234618
           Summary: Add package for Brother printers
    Classification: openSUSE
           Product: openSUSE Aeon
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Patterns
          Assignee: rbrown-at-suse.com
          Reporter: emtorres-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I have a Brother laser printer.
The system correctly autodetects the printer, but since it does not have the
'brlaser' driver, it adds it as if it were an HP printer.

It could be useful as it supports multiple Brother laser printers (don't kn=
ow
how popular Brother printers are :)).

The package is printer-driver-brlaser
Thanks
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17342165401.e7c55B.11
Date: Sat, 14 Dec 2024 22:49:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234618

          Summary
          Add package for Brother printers

          Classification
          openSUSE

          Product
          openSUSE Aeon

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Patterns

          Assignee
          rbrown@suse.com

          Reporter
          emtorres@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I have a Brother laser printer.
The system correctly autodetects the printer, but since it does not have the
'brlaser' driver, it adds it as if it were an HP printer.

It could be useful as it supports multiple Brother laser printers (don't kn=
ow
how popular Brother printers are :)).

The package is printer-driver-brlaser
Thanks

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17342165401.e7c55B.11--

summary: Add package for Brother printers


--17342576551.c023b.23
Date: Sun, 15 Dec 2024 10:14:15 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234623

            Bug ID: 1234623
           Summary: DPC: RP PIO log size 0 is invalid (quirk needs to be added)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: bjorn.lie-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 879176
  --> https://bugzilla.suse.com/attachment.cgi?id=3D879176&action=3Dedit
dmesg

Hi Kernel people, this bug is mainly a "cosmetic" one that causes a "blip"
during boot with plymouth, it has no real impact, but would be nice to have=
 it
fix in any case (device id added to quirk list).

Kernel 6.11.8-1-default


body:
--17343407140.F2F4df.224
Date: Mon, 16 Dec 2024 09:18:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234629

            Bug ID: 1234629
           Summary: sendmail: embeds uname -r
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: werner-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1101107
  Target Milestone: ---
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
our sendmail debuginfo package embeds the build machine's kernel version.

With my reproducibleopensuse tools, I do
debuginfo=3D--debuginfo vmtype=3D--vm-type=3Dpodman rbk

Here is a helpful part of the diff:

filterdiff strings R*/usr/lib/debug/.dwz/sendmail-8.18.1-1.1.x86_64
-

summary: sendmail: embeds uname -r


--17344252902.e9b8a.176
Date: Tue, 17 Dec 2024 08:48:10 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234646

            Bug ID: 1234646
           Summary: Lockdown is not activated with Secure Boot in kernel 6.12
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: jlee-at-suse.com
          Reporter: arvidjaar-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
                CC: jslaby-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Kernel 6.12 moved initialization of lockdown LSM after arch setup. SUSE ker=
nel
tries to activate lockdown in arch setup if Secure Boot is detected which d=
oes
not work anymore.

The upstream commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/i=
nit/main.c?id=3D77b644c39d6afc0b2985807c74d95335931f6403

See also the mailing list thread:
https://lists.opensuse.org/archives/list/kernel-at-lists.opensuse.org/thread/I=
KIOMOEWFFFHTC5DIX7CUWXSIPVQM7IJ/
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17344252902.e9b8a.176
Date: Tue, 17 Dec 2024 08:48:10 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234646

          Summary
          Lockdown is not activated with Secure Boot in kernel 6.12

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          jlee@suse.com

          Reporter
          arvidjaar@gmail.com

          QA Contact
          qa-bugs@suse.de

          CC
          jslaby@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Kernel 6.12 moved initialization of lockdown LSM after arch =
setup. SUSE kernel
tries to activate lockdown in arch setup if Secure Boot is detected which d=
oes
not work anymore.

The upstream commit:
https:=
//git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/init/ma=
in.c?id=3D77b644c39d6afc0b2985807c74d95335931f6403

See also the mailing list thread:
https://lists.opensuse.org=
/archives/list/kernel@lists.opensuse.org/thread/IKIOMOEWFFFHTC5DIX7CUWX=
SIPVQM7IJ/

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17344252902.e9b8a.176--


--17344684863.EEf56.584
Date: Tue, 17 Dec 2024 20:48:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1234673

            Bug ID: 1234673
           Summary: Emacs freeze for a few seconds when opening any python file, with 100% Xorg usage
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pujos.michael-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Observed on TW20241215

Here's a weird one:

When I open any Python file (whether existing or not, size of file does not
matter) with 'emacs file.py', emacs freezes up to 10 seconds before I can t=
ype
in the frame. No other file type cause this issue.

top shows that Xorg is taking 100% CPU usage while the emacs process itself=
 has
low CPU usage.

starting emacs with -q to not load .emacs and friends does not fix it.
However starting 'emacs -nw file.py' does not freeze, as Xorg is not used.

So it seems to be a weird Xorg + emacs Python mode issue that I have a hard
time comprehend.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17344684863.EEf56.584
Date: Tue, 17 Dec 2024 20:48:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1234673

          Summary
          Emacs freeze for a few seconds when opening any python file, =
with 100% Xorg usage

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          pujos.michael@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Observed on TW20241215

Here's a weird one:

When I open any Python file (whether existing or not, size of file does not
matter) with 'emacs file.py', emacs freezes up to 10 seconds before I can t=
ype
in the frame. No other file type cause this issue.

top shows that Xorg is taking 100% CPU usage while the emacs process itself=
 has
low CPU usage.

starting emacs with -q to not load .emacs and friends does not fix it.
However starting 'emacs -nw file.py' does not freeze, as Xorg is not used.

So it seems to be a weird Xorg + emacs Python mode issue that I have a hard
time comprehend.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17344684863.EEf56.584--