--17157112850.1f8ebcd.5904
Date: Tue, 14 May 2024 18:28:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224239

            Bug ID: 1224239
           Summary: VUL-0: CVE-2024-31460: cacti: SQL injection vulnerability when using tree rules through Automation API
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405132/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. Pr=
ior
to version 1.2.27, some of the data stored in `automation_tree_rules.php` is
not thoroughly checked and is used to concatenate the SQL statement in
`create_all_header_nodes()`  function from `lib/api_automation.php` , final=
ly
resulting in SQL injection. Using SQL based secondary injection technology,
attackers can modify the contents of the Cacti database, and based on the
modified content, it may be possible to achieve further impact, such as
arbitrary file reading, and even remote code execution through arbitrary fi=
le
writing. Version 1.2.27 contains a patch for the issue.

References:
https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv
https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31460
https://www.cve.org/CVERecord?id=3DCVE-2024-31460
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157112850.1f8ebcd.5904
Date: Tue, 14 May 2024 18:28:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224239

          Summary
          VUL-0: CVE-2024-31460: cacti: SQL injection vulnerability whe=
n using tree rules through Automation API

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405132/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. Prior
to version 1.2.27, some of the data stored in `automation_tree_rules.php` is
not thoroughly checked and is used to concatenate the SQL statement in
`create_all_header_nodes()`  function from `lib/api_automation.php` , final=
ly
resulting in SQL injection. Using SQL based secondary injection technology,
attackers can modify the contents of the Cacti database, and based on the
modified content, it may be possible to achieve further impact, such as
arbitrary file reading, and even remote code execution through arbitrary fi=
le
writing. Version 1.2.27 contains a patch for the issue.

References:
https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p=
2rv
https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-g=
h8r
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31460
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-31460

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157112850.1f8ebcd.5904--


--17157122374.Be8aa.5922
Date: Tue, 14 May 2024 18:43:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224241

            Bug ID: 1224241
           Summary: VUL-0: CVE-2024-34340: cacti: Authentication Bypass when using using older password hashes
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://github.com/cacti/cacti/security/advisories/GHSA-37x7-mfjv-mm7m

Md5-hashed user input is compared with correct password in database by $md5=
 =3D=3D
$hash. It is a loose comparison, not =3D=3D=3D. It is a type juggling vulne=
rability.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157122374.Be8aa.5922
Date: Tue, 14 May 2024 18:43:57 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224241

          Summary
          VUL-0: CVE-2024-34340: cacti: Authentication Bypass when usin=
g using older password hashes

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://github.com/cacti/cacti/security/advisories/G=
HSA-37x7-mfjv-mm7m

Md5-hashed user input is compared with correct password in database by $md5=
 =3D=3D
$hash. It is a loose comparison, not =3D=3D=3D. It is a type juggling vulne=
rability.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157122374.Be8aa.5922--


--17157122162.b78C.5919
Date: Tue, 14 May 2024 18:43:36 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224240

            Bug ID: 1224240
           Summary: VUL-0: CVE-2024-31458: cacti: SQL Injection vulnerability when using form templates
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Fixed in 1.2.27

Some of the data stored in automation_tree_rules.php is not thoroughly chec=
ked
and is used to concatenate the SQL statement in
create_all_header_nodes() function from lib/api_automation.php , finally
resulting in SQL injection.

https://github.com/cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157122162.b78C.5919
Date: Tue, 14 May 2024 18:43:36 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224240

          Summary
          VUL-0: CVE-2024-31458: cacti: SQL Injection vulnerability whe=
n using form templates

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Fixed in 1.2.27

Some of the data stored in automation_tree_rules.php is not thoroughly chec=
ked
and is used to concatenate the SQL statement in
create_all_header_nodes() function from lib/api_automation.php , finally
resulting in SQL injection.

https://github.com/cacti/cacti/security/advisories/GHSA-gj3f-p326-g=
h8r

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157122162.b78C.5919--


--17157761230.6FDBfC2BC.7674
Date: Wed, 15 May 2024 12:28:43 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224308

            Bug ID: 1224308
           Summary: VUL-0: CVE-2024-4068: traefik: the npm package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405385/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: alexandre.vicenzi-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: gabriele.sonnu-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

The NPM package `braces` fails to limit the number of characters it can han=
dle,
which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious us=
er
sends "imbalanced braces" as input, the parsing will enter a loop, which wi=
ll
cause the program to start allocating heap memory without freeing it at any
moment of the loop. Eventually, the JavaScript heap limit is reached, and t=
he
program will crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-4068
https://www.cve.org/CVERecord?id=3DCVE-2024-4068
https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5d=
e747e0d/lib/parse.js#L308
https://github.com/micromatch/braces/issues/35
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157761230.6FDBfC2BC.7674
Date: Wed, 15 May 2024 12:28:43 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          <a class=3D"bz_bug_link=20
          bz_status_NEW "
   title=3D"NEW - VUL-0: CVE-2024-4068: traefik: the npm package `braces` f=
ails to limit the number of characters it can handle, which could lead to M=
emory Exhaustion"
   href=3D"https://bugzilla.suse.com/show_bug.cgi?id=3D1224308">1224308

          Summary
          VUL-0: CVE-2024-4068: traefik: the npm package `braces` fails=
 to limit the number of characters it can handle, which could lead to Memor=
y Exhaustion

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405385/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          alexandre.vicenzi@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          gabriele.sonnu@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

The NPM package `braces` fails to limit the number of charac=
ters it can handle,
which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious us=
er
sends "imbalanced braces" as input, the parsing will enter a loop=
, which will
cause the program to start allocating heap memory without freeing it at any
moment of the loop. Eventually, the JavaScript heap limit is reached, and t=
he
program will crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-4068
https://www.cv=
e.org/CVERecord?id=3DCVE-2024-4068
https:/=
/devhub.checkmarx.com/cve-details/CVE-2024-4068/
https://github.com/micromatch/braces/=
blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308
https://github.c=
om/micromatch/braces/issues/35

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157761230.6FDBfC2BC.7674--


--17157990551.2419a5e1C.8486
Date: Wed, 15 May 2024 18:50:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224328

            Bug ID: 1224328
           Summary: with new aeon, the folder names are not adapted to the system language
    Classification: openSUSE
           Product: openSUSE Aeon
           Version: Current
          Hardware: 64bit
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Base
          Assignee: rbrown-at-suse.com
          Reporter: hotel-brot.0z-at-icloud.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

even after zypper aloc the names of the folders remain in english. normally
there is a dialog that asks if you want to change folder names like Music or
Pictures to the current language but this is not the case here.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157990551.2419a5e1C.8486
Date: Wed, 15 May 2024 18:50:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224328

          Summary
          with new aeon, the folder names are not adapted to the system=
 language

          Classification
          openSUSE

          Product
          openSUSE Aeon

          Version
          Current

          Hardware
          64bit

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Base

          Assignee
          rbrown@suse.com

          Reporter
          hotel-brot.0z@icloud.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

even after zypper aloc the names of the folders remain in en=
glish. normally
there is a dialog that asks if you want to change folder names like Music or
Pictures to the current language but this is not the case here.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157990551.2419a5e1C.8486--


--17158593331.bCe30bD8b.9902
Date: Thu, 16 May 2024 11:35:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224356

            Bug ID: 1224356
           Summary: /usr/share/p11-kit/modules/softhsm.module contains garbage after installing softhsm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: daan.j.demeyer-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

After installing the softhsm 2.6.1-1.1 package on opensuse Tumbleweed,
/usr/share/p11-kit/modules/softhsm.module seems to contain garbage:

```
daandemeyer-fedora-PC1EV17T:/work/src # cat
/usr/share/p11-kit/modules/softhsm.module=20
=EF=BF=BD^=EF=BF=BD=EF=BF=BD
        A=EF=BF=BD#=EF=BF=BDO=EF=BF=BD
=20=20=20=20=20=20=20=20=20=20=20=20=20
=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD%=EF=BF=BD=C4=962=EF=BF=BD=EF=
=BF=BDa2=EF=BF=BD=EF=BF=BDX4~=EF=BF=BDQ=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=
=EF=BF=BD=EF=BF=BD=EF=BF=BDp=EF=BF=BD+=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDv=
=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDK=EF=BF=BDu=EF=BF=BD=C4=A4=EF=BF=BD!=EF=
=BF=BD=EF=BF=BD=EF=BF=BD]\>=EF=BF=BD=EF=BF=BD=EF=BF=BDD/=EF=BF=BD7p>=EF=BF=
=BD=EF=BF=BD=EF=BF=BD>tb7=EF=BF=BD=EF=BF=BD}=EF=BF=BD=EF=BF=BD=EF=BF=BDR=EF=
=BF=BD:w=EF=BF=BDQ?=EF=BF=BD=E2=96=92=EF=BF=BD=EF=BF=BD=EF=BF=BD^=EF=BF=BDH=
=E2=96=92.=EF=BF=BDPl=EF=BF=BD=EF=BF=BDs3i=EF=BF=BD=EF=BF=BD=CD=BF$=EF=BF=
=BD=EF=BF=BD`d=EF=BF=BD=EF=BF=BD=EF=BF=BD4wRNw]=EF=BF=BDi=EF=BF=BD+=EF=BF=
=BDI=EF=BF=BD=EF=BF=BD[=EF=BF=BDD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD/=EF=
=BF=BD=EF=BF=BD*=3D=EF=BF=BD=EF=BF=BD=EF=BF=BD=D6=8C=EF=BF=BD=EF=BF=BD=C7=
=AD!=EF=BF=BD-p^1f=EF=BF=BDeW=EF=BF=BD=EF=BF=BDj5%=EF=BF=BD=EF=BF=BD=EF=BF=
=BD=D2=B0o=EF=BF=BD{=EF=BF=BD=EF=BF=BDL=EF=BF=BDht=EF=BF=BD'K=EF=BF=BD=EF=
=BF=BD&=EF=BF=BDD=EF=BF=BD?=EF=BF=BD=EF=BF=BDE05n-}=EF=BF=BD'i',pM-kPn31Wa=
=EF=BF=BDH=EF=BF=BD=EF=BF=BDB!=EF=BF=BD=3D=EF=BF=BD=EF=BF=BD=EF=BF=BDt'=EF=
=BF=BD=EF=BF=BDJs=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=C3=
=93P&=EF=BF=BD=EF=BF=BD=EF=BF=BDO=EF=BF=BD=EF=BF=BD=D9=8A=EF=BF=BD=E2=96=92=
=EF=BF=BDh=EF=BF=BD=EF=BF=BD=EF=BF=BDFx7w=E2=96=92WGH5=EF=BF=BD=EF=BF=BD
                                 =EF=BF=BD5*
=EF=BF=BDN+=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDC=EF=BF=BD=EF=BF=BD=
=EF=BF=BDHu=EF=BF=BD=EF=BF=BD=EF=BF=BDWp=EF=BF=BD=EF=BF=BD=EF=BF=BDkB~O=EF=
=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDy=EF=BF=BD.=EF=BF=BD
=EF=BF=BD=EF=BF=BD7k@&=EF=BF=BD=EF=BF=BD.y=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=
=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD9=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=
=BDW=EF=BF=BD=D1=ABF4=EF=BF=BDKX=EF=BF=BD=EF=BF=BD9=EF=BF=BD)=EF=BF=BD2=EF=
=BF=BD=EF=BF=BDv=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD#5W=EF=BF=BD=EF=BF=BD=
=EF=BF=BD=EF=BF=BD=EF=BF=BDFA=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD?L=EF=BF=
=BDs=EF=BF=BD(=EF=BF=BD=EF=BF=BDm=EF=BF=BD=EF=BF=BD_=EF=BF=BDW=EF=BF=BD=EF=
=BF=BDC+N=EF=BF=BD_
=EF=BF=BD-=EF=BF=BD=EF=BF=BDB=EF=BF=BD=C8=90=EF=BF=BD2$=EF=BF=BDj=EF=BF=BD:=
j=EF=BF=BDh=EF=BF=BD_(=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDf=EF=BF=BDa=EF=BF=
=BD=EF=BF=BD(=EF=BF=BD=EF=BF=BD=20=20=20=20=20=20=20=20
daandemeyer-fedora-PC1EV17T:/work/src # cat
/usr/share/p11-kit/modules/softhsm2.module=20
# This file describes how to load the pk11 module
# See: http://p11-glue.freedesktop.org/doc/p11-kit/config.html

module: /usr/lib64/pkcs11/libsofthsm2.so
```

```
daandemeyer-fedora-PC1EV17T:/work/src # rpm -qi softhsm
Name        : softhsm
Version     : 2.6.1
Release     : 1.1
Architecture: x86_64
Install Date: Thu May 16 11:08:08 2024
Group       : Unspecified
Size        : 1546547
License     : BSD-2-Clause
Signature   : RSA/SHA512, Sun May 12 22:02:14 2024, Key ID 35a2f86e29b700a4
Source RPM  : softhsm-2.6.1-1.1.src.rpm
Build Date  : Sat May 11 16:00:16 2024
Build Host  : reproducible
Packager    : https://bugs.opensuse.org
Vendor      : openSUSE
URL         : https://www.opendnssec.org/
Summary     : Software version of a PKCS#11 Hardware Security Module
Description :
OpenDNSSEC is providing a software implementation of a generic
cryptographic device with a PKCS#11 interface, the SoftHSM. SoftHSM is
designed to meet the requirements of OpenDNSSEC, but can also work together
with other cryptographic products because of the PKCS#11 interface.
Distribution: openSUSE Tumbleweed
```
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17158593331.bCe30bD8b.9902
Date: Thu, 16 May 2024 11:35:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224356

          Summary
          /usr/share/p11-kit/modules/softhsm.module contains garbage af=
ter installing softhsm

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          daan.j.demeyer@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

After installing the softhsm 2.6.1-1.1 package on opensuse T=
umbleweed,
/usr/share/p11-kit/modules/softhsm.module seems to contain garbage:

```
daandemeyer-fedora-PC1EV17T:/work/src # cat
/usr/share/p11-kit/modules/softhsm.module=20
=EF=BF=BD^=EF=BF=BD=EF=BF=BD
        A=EF=BF=BD#=EF=BF=BDO=EF=BF=BD
=20=20=20=20=20=20=20=20=20=20=20=20=20
=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD%=EF=BF=BD=C4=962=EF=BF=BD=EF=
=BF=BDa2=EF=BF=BD=EF=BF=BDX4~=EF=BF=BDQ=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=
=EF=BF=BD=EF=BF=BD=EF=BF=BDp=EF=BF=BD+=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDv=
=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDK=EF=BF=BDu=EF=BF=BD=C4=A4=EF=BF=BD!=EF=
=BF=BD=EF=BF=BD=EF=BF=BD]\>=EF=BF=BD=EF=BF=BD=EF=BF=BDD/=EF=BF=BD7p>=
=EF=BF=BD=EF=BF=BD=EF=BF=BD>tb7=EF=BF=BD=EF=BF=BD}=EF=BF=BD=EF=BF=BD=EF=
=BF=BDR=EF=BF=BD:w=EF=BF=BDQ?=EF=BF=BD=E2=96=92=EF=BF=BD=EF=BF=BD=EF=BF=BD^=
=EF=BF=BDH=E2=96=92.=EF=BF=BDPl=EF=BF=BD=EF=BF=BDs3i=EF=BF=BD=EF=BF=BD=CD=
=BF$=EF=BF=BD=EF=BF=BD`d=EF=BF=BD=EF=BF=BD=EF=BF=BD4wRNw]=EF=BF=BDi=EF=BF=
=BD+=EF=BF=BDI=EF=BF=BD=EF=BF=BD[=EF=BF=BDD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=
=BF=BD/=EF=BF=BD=EF=BF=BD*=3D=EF=BF=BD=EF=BF=BD=EF=BF=BD=D6=8C=EF=BF=BD=EF=
=BF=BD=C7=AD!=EF=BF=BD-p^1f=EF=BF=BDeW=EF=BF=BD=EF=BF=BDj5%=EF=BF=BD=EF=BF=
=BD=EF=BF=BD=D2=B0o=EF=BF=BD{=EF=BF=BD=EF=BF=BDL=EF=BF=BDht=EF=BF=BD'K=EF=
=BF=BD=EF=BF=BD&=EF=BF=BDD=EF=BF=BD?=EF=BF=BD=EF=BF=BDE05n-}=EF=BF=BD'i=
',pM-kPn31Wa=EF=BF=BDH=EF=BF=BD=EF=BF=BDB!=EF=BF=BD=3D=EF=BF=BD=EF=BF=BD=EF=
=BF=BDt'=EF=BF=BD=EF=BF=BDJs=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=
=EF=BF=BD=C3=93P&=EF=BF=BD=EF=BF=BD=EF=BF=BDO=EF=BF=BD=EF=BF=BD=D9=8A=
=EF=BF=BD=E2=96=92=EF=BF=BDh=EF=BF=BD=EF=BF=BD=EF=BF=BDFx7w=E2=96=92WGH5=EF=
=BF=BD=EF=BF=BD
                                 =EF=BF=BD5*
=EF=BF=BDN+=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDC=EF=BF=BD=EF=BF=BD=
=EF=BF=BDHu=EF=BF=BD=EF=BF=BD=EF=BF=BDWp=EF=BF=BD=EF=BF=BD=EF=BF=BDkB~O=EF=
=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDy=EF=BF=BD.=EF=BF=BD
=EF=BF=BD=EF=BF=BD7k@&=EF=BF=BD=EF=BF=BD.y=EF=BF=BD=EF=BF=BD=EF=BF=
=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD9=EF=BF=BD=EF=BF=BD=EF=BF=
=BD=EF=BF=BDW=EF=BF=BD=D1=ABF4=EF=BF=BDKX=EF=BF=BD=EF=BF=BD9=EF=BF=BD)=EF=
=BF=BD2=EF=BF=BD=EF=BF=BDv=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD#5W=EF=BF=BD=
=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDFA=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD?=
L=EF=BF=BDs=EF=BF=BD(=EF=BF=BD=EF=BF=BDm=EF=BF=BD=EF=BF=BD_=EF=BF=BDW=EF=BF=
=BD=EF=BF=BDC+N=EF=BF=BD_
=EF=BF=BD-=EF=BF=BD=EF=BF=BDB=EF=BF=BD=C8=90=EF=BF=BD2$=EF=BF=BDj=EF=BF=BD:=
j=EF=BF=BDh=EF=BF=BD_(=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BDf=EF=BF=BDa=EF=BF=
=BD=EF=BF=BD(=EF=BF=BD=EF=BF=BD=20=20=20=20=20=20=20=20
daandemeyer-fedora-PC1EV17T:/work/src # cat
/usr/share/p11-kit/modules/softhsm2.module=20
# This file describes how to load the pk11 module
# See: <a href=3D"http://p11-glue.freedesktop.org/doc/p11-kit/config.html">=
http://p11-glue.freedesktop.org/doc/p11-kit/config.html</a>

module: /usr/lib64/pkcs11/libsofthsm2.so
```

```
daandemeyer-fedora-PC1EV17T:/work/src # rpm -qi softhsm
Name        : softhsm
Version     : 2.6.1
Release     : 1.1
Architecture: x86_64
Install Date: Thu May 16 11:08:08 2024
Group       : Unspecified
Size        : 1546547
License     : BSD-2-Clause
Signature   : RSA/SHA512, Sun May 12 22:02:14 2024, Key ID 35a2f86e29b700a4
Source RPM  : softhsm-2.6.1-1.1.src.rpm
Build Date  : Sat May 11 16:00:16 2024
Build Host  : reproducible
Packager    : <a href=3D"https://bugs.opensuse.org">https://bugs.opensuse.o=
rg</a>
Vendor      : openSUSE
URL         : <a href=3D"https://www.opendnssec.org/">https://www.opendnsse=
c.org/</a>
Summary     : Software version of a PKCS#11 Hardware Security Module
Description :
OpenDNSSEC is providing a software implementation of a generic
cryptographic device with a PKCS#11 interface, the SoftHSM. SoftHSM is
designed to meet the requirements of OpenDNSSEC, but can also work together
with other cryptographic products because of the PKCS#11 interface.
Distribution: openSUSE Tumbleweed
```

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17158593331.bCe30bD8b.9902--


--17158656890.A41A539e.10292
Date: Thu, 16 May 2024 13:21:29 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224384

            Bug ID: 1224384
           Summary: VUL-0: CVE-2024-4068: traefik: the npm package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405384/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: alexandre.vicenzi-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: gabriele.sonnu-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

The NPM package `micromatch` is vulnerable to Regular Expression Denial of
Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in
`index.js` because the pattern `.*` will greedily match anything. By passin=
g a
malicious payload, the pattern matching will keep backtracking to the input
while it doesn't find the closing bracket. As the input size increases, the
consumption time will also increase until it causes the application to hang=
 or
slow down. There was a merged fix but further testing shows the issue persi=
sts.
This issue should be mitigated by using a safe pattern that won't start
backtracking the regular expression due to greedy matching.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-4067
https://www.cve.org/CVERecord?id=3DCVE-2024-4067
https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0=
865a339747a/index.js#L448
https://github.com/micromatch/micromatch/issues/243
https://github.com/micromatch/micromatch/pull/247
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17158656890.A41A539e.10292
Date: Thu, 16 May 2024 13:21:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224384

          Summary
          VUL-0: CVE-2024-4068: traefik: the npm package `micromatch` i=
s vulnerable to Regular Expression Denial of Service (ReDoS)

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405384/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          alexandre.vicenzi@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          gabriele.sonnu@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

The NPM package `micromatch` is vulnerable to Regular Expres=
sion Denial of
Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in
`index.js` because the pattern `.*` will greedily match anything. By passin=
g a
malicious payload, the pattern matching will keep backtracking to the input
while it doesn't find the closing bracket. As the input size increases, the
consumption time will also increase until it causes the application to hang=
 or
slow down. There was a merged fix but further testing shows the issue persi=
sts.
This issue should be mitigated by using a safe pattern that won't start
backtracking the regular expression due to greedy matching.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-4067
https://www.cv=
e.org/CVERecord?id=3DCVE-2024-4067
https:/=
/devhub.checkmarx.com/cve-details/CVE-2024-4067/
https://github.com/micromatch/microma=
tch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
https://git=
hub.com/micromatch/micromatch/issues/243
https://githu=
b.com/micromatch/micromatch/pull/247

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17158656890.A41A539e.10292--


--17158699960.20Ccdb8D.10532
Date: Thu, 16 May 2024 14:33:16 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224386

            Bug ID: 1224386
           Summary: Please package systemd-resolved seperate from systemd-network
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: systemd-maintainers-at-suse.de
          Reporter: rbrown-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I get why resolved is packaged with networkd but there's also use cases whe=
re
resolved would be very , very useful, even with NetworkManager

eg. I want it for openSUSE Aeon, with GNOME, with NetworkManager, but using
resovled for more intelligent DNS resolution as people hop networks/VPNs.

Could we please package -resolved as it's own seperate thing and have it
required by -networkd, as I really wouldn't like to have -networkd installe=
d if
I can avoid it.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17158699960.20Ccdb8D.10532
Date: Thu, 16 May 2024 14:33:16 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224386

          Summary
          Please package systemd-resolved seperate from systemd-network

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          systemd-maintainers@suse.de

          Reporter
          rbrown@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I get why resolved is packaged with networkd but there's als=
o use cases where
resolved would be very , very useful, even with NetworkManager

eg. I want it for openSUSE Aeon, with GNOME, with NetworkManager, but using
resovled for more intelligent DNS resolution as people hop networks/VPNs.

Could we please package -resolved as it's own seperate thing and have it
required by -networkd, as I really wouldn't like to have -networkd installe=
d if
I can avoid it.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17158699960.20Ccdb8D.10532--


--17161915730.6c92De8.14895
Date: Mon, 20 May 2024 07:52:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224467

            Bug ID: 1224467
           Summary: VUL-0: CVE-2024-34083: python-aiosmtpd: MiTM attack could inject extra unencrypted commands after STARTTLS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/406536/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: python-maintainers-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

aiosmptd is  a reimplementation of the Python stdlib smtpd.py based on asyn=
cio.
Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted
commands after STARTTLS, treating them as if they came from inside the
encrypted connection. This could be exploited by a man-in-the-middle attack.
Version 1.4.6 contains a patch for the issue.

References:
https://nostarttls.secvuln.info
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-34083
https://www.cve.org/CVERecord?id=3DCVE-2024-34083
https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6ecfd228856a20d637dc3835=
41fcdbfda
https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA-wgjv-9j3q-jhg8
https://bugzilla.redhat.com/show_bug.cgi?id=3D2281505
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17161915730.6c92De8.14895
Date: Mon, 20 May 2024 07:52:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224467

          Summary
          VUL-0: CVE-2024-34083: python-aiosmtpd: MiTM attack could inj=
ect extra unencrypted commands after STARTTLS

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/406536/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          python-maintainers@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

aiosmptd is  a reimplementation of the Python stdlib smtpd.p=
y based on asyncio.
Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted
commands after STARTTLS, treating them as if they came from inside the
encrypted connection. This could be exploited by a man-in-the-middle attack.
Version 1.4.6 contains a patch for the issue.

References:
https://nostarttls.secvuln.info=

http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-34083
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-34083
https://github.com/aio-libs/aiosmtpd/commit/b3a4a2c6e=
cfd228856a20d637dc383541fcdbfda
https://github.com/aio-libs/aiosmtpd/security/advisories/GHSA=
-wgjv-9j3q-jhg8
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2281505

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17161915730.6c92De8.14895--


body:
Gecko/20100101
Firefox/126.0
Build Identifier:=20

for example, if i enable fractional scaling in dconf, after a reboot dconf
still shows that i have enabled it, but it doesn't work. if i then try using
the gsettings command, it works. the same with other settings such as theme.
changed settings via the terminal are not displayed in dconf.
The logs when starting from the terminal show nothing at all.

Reproducible: Always

Steps to Reproduce:
1.The logs when starting from the terminal show nothing at all.
2.restart
3.notice that the setting has not been applied

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17161992111.2fc0a4.15102--

summary: dconf settings are not being applied


body:
Gecko/20100101
Firefox/126.0
Build Identifier:=20

Keyboard shortcuts set in gnome-control-center under the Keyboard category =
will
reset to default after a reboot.

Reproducible: Always

Steps to Reproduce:
1.make a setting such as alt + m to mute the microphone
2.restart
3.determine that the setting has been reset
Actual Results:=20=20
Default settings

Expected Results:=20=20
that the setting is noticed

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17161999180.03dAA0Ee.15135--

summary: Keyboard shortcuts set in gnome-control-center under the Keyboard category will reset to default after a reboot.


--17162021800.ac2C.15183
Date: Mon, 20 May 2024 10:49:40 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224474

            Bug ID: 1224474
           Summary: VUL-0: CVE-2024-1968: python-Scrapy: HTTP redirects followed regardless of the URL protocol
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/406671/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

In scrapy/scrapy, an issue was identified where the Authorization header is=
 not
removed during redirects that only change the scheme (e.g., HTTPS to HTTP) =
but
remain within the same domain. This behavior contravenes the Fetch standard,
which mandates the removal of Authorization headers in cross-origin requests
when the scheme, host, or port changes. Consequently, when a redirect
downgrades from HTTPS to HTTP, the Authorization header may be inadvertently
exposed in plaintext, leading to potential sensitive information disclosure=
 to
unauthorized actors. The flaw is located in the _build_redirect_request
function of the redirect middleware.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-1968
https://www.cve.org/CVERecord?id=3DCVE-2024-1968
https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22899af915623fda1aae=
b9dd8
https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17162021800.ac2C.15183
Date: Mon, 20 May 2024 10:49:40 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224474

          Summary
          VUL-0: CVE-2024-1968: python-Scrapy: HTTP redirects followed =
regardless of the URL protocol

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/406671/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

In scrapy/scrapy, an issue was identified where the Authoriz=
ation header is not
removed during redirects that only change the scheme (e.g., HTTPS to HTTP) =
but
remain within the same domain. This behavior contravenes the Fetch standard,
which mandates the removal of Authorization headers in cross-origin requests
when the scheme, host, or port changes. Consequently, when a redirect
downgrades from HTTPS to HTTP, the Authorization header may be inadvertently
exposed in plaintext, leading to potential sensitive information disclosure=
 to
unauthorized actors. The flaw is located in the _build_redirect_request
function of the redirect middleware.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-1968
https://www.cv=
e.org/CVERecord?id=3DCVE-2024-1968
https://github.com/scrapy/scrapy/commit/1d0502f25bbe55a22=
899af915623fda1aaeb9dd8
https://huntr.com/bounties/27f6a021-a891-446a-ada5-0226d619dd1a

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17162021800.ac2C.15183--


--17162338680.DFFaD.16196
Date: Mon, 20 May 2024 19:37:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224770

            Bug ID: 1224770
           Summary: a2ps completely b0rken due to a2ps-lpr-wrapper requiring a file name
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Printing
          Assignee: jsmeix-at-suse.com
          Reporter: 7eggert-at-gmx.de
        QA Contact: jsmeix-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

a2ps depends on `lpr -P foo` to print from stdin when no file name is given.
The wrapper prevents this from happening, it requires a file name. It cannot
work.

$ rpm -q a2ps
a2ps-4.15.5-2.2.x86_64

$ strace -feexecve  a2ps -P test /dev/null
execve("/usr/bin/a2ps", ["a2ps", "-P", "test", "/dev/null"], 0x7ffdc7a2adc0=
 /*
108 vars */) =3D 0
strace: Process 8185 attached
[pid  8185] execve("/bin/sh", ["sh", "-c", "--", "/usr/bin/file -L
'/dev/null'"], 0x7ffd14eca980 /* 108 vars */) =3D 0
[pid  8185] execve("/usr/bin/file", ["/usr/bin/file", "-L", "/dev/null"],
0x558f5f7cb300 /* 107 vars */) =3D 0
[pid  8185] +++ exited with 0 +++
-


--17162608301.0DBd14cf.16442
Date: Tue, 21 May 2024 03:07:10 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224773

            Bug ID: 1224773
           Summary: Cannot install NVIDIA drivers in latest Aeon RC2
    Classification: openSUSE
           Product: openSUSE Aeon
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: rbrown-at-suse.com
          Reporter: sunscape1-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Installing NVIDIA drivers in Aeon RC2
(https://en.opensuse.org/SDB:NVIDIA_drivers) fails because the MOK cannot be
enrolled after boot. Error during installation using pkg is:

SKIP: /var/lib/nvidia-pubkeys/MOK-nvidia-driver-G06-550.78-22.1-default.der=
 is
not in MokList

Without the nvidia-pubkeys folder it is impossible to enroll the MOK or try=
 to
enable it after reboot. The key doesn't exist :(
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17162608301.0DBd14cf.16442
Date: Tue, 21 May 2024 03:07:10 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224773

          Summary
          Cannot install NVIDIA drivers in latest Aeon RC2

          Classification
          openSUSE

          Product
          openSUSE Aeon

          Version
          Current

          Hardware
          x86-64

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Installation

          Assignee
          rbrown@suse.com

          Reporter
          sunscape1@hotmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Installing NVIDIA drivers in Aeon RC2
(https://en.opensuse=
.org/SDB:NVIDIA_drivers) fails because the MOK cannot be
enrolled after boot. Error during installation using pkg is:

SKIP: /var/lib/nvidia-pubkeys/MOK-nvidia-driver-G06-550.78-22.1-default.der=
 is
not in MokList

Without the nvidia-pubkeys folder it is impossible to enroll the MOK or try=
 to
enable it after reboot. The key doesn't exist :(

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17162608301.0DBd14cf.16442--


--17162827487.f69a.17663
Date: Tue, 21 May 2024 09:12:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224782

            Bug ID: 1224782
           Summary: CVE-2024-36048 qtnetworkauth: data race and poor seeding in generateRandomString()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: christophe-at-krop.fr
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

(Adding the bug report since I'm preparing the qt6-networkauth fixes)

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before
6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.=
7.1
uses only the time to seed the PRNG, which may result in guessable values.

https://www.cve.org/CVERecord?id=3DCVE-2024-36048
https://nvd.nist.gov/vuln/detail/CVE-2024-36048

Affected:

qt6-networkauth packages in:
openSUSE:Factory (6.7.1 packaging in progress)
openSUSE:Backports:SLE15-SP5
openSUSE:Backports:SLE15-SP6

libqt5-qtnetworkauth:
openSUSE:Factory
openSUSE:Backports:SLE15-SP5
openSUSE:Backports:SLE15-SP6
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17162827487.f69a.17663
Date: Tue, 21 May 2024 09:12:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224782

          Summary
          CVE-2024-36048 qtnetworkauth: data race and poor seeding in g=
enerateRandomString()

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          christophe@krop.fr

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

(Adding the bug report since I'm preparing the qt6-networkau=
th fixes)

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before
6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.=
7.1
uses only the time to seed the PRNG, which may result in guessable values.

https://www.c=
ve.org/CVERecord?id=3DCVE-2024-36048
https://nvd.nis=
t.gov/vuln/detail/CVE-2024-36048

Affected:

qt6-networkauth packages in:
openSUSE:Factory (6.7.1 packaging in progress)
openSUSE:Backports:SLE15-SP5
openSUSE:Backports:SLE15-SP6

libqt5-qtnetworkauth:
openSUSE:Factory
openSUSE:Backports:SLE15-SP5
openSUSE:Backports:SLE15-SP6

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17162827487.f69a.17663--


--17163066462.bFA4B.19108
Date: Tue, 21 May 2024 15:50:46 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224812

            Bug ID: 1224812
           Summary: 'uptime' is missing or package coreutils-systemd intentionally not included?
    Classification: openSUSE
           Product: openSUSE Aeon
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Base
          Assignee: rbrown-at-suse.com
          Reporter: sunscape1-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

As the summary says, 'uptime' isn't present in the default install. Every o=
ther
tool like ps, top, etc. from procps is there, but uptime was moved to
coreutils-systemd.

Include coreutils-systemd in the default install? I had no idea it had move=
d.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17163066462.bFA4B.19108
Date: Tue, 21 May 2024 15:50:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224812

          Summary
          'uptime' is missing or package coreutils-systemd intentionall=
y not included?

          Classification
          openSUSE

          Product
          openSUSE Aeon

          Version
          Current

          Hardware
          x86-64

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Base

          Assignee
          rbrown@suse.com

          Reporter
          sunscape1@hotmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

As the summary says, 'uptime' isn't present in the default i=
nstall. Every other
tool like ps, top, etc. from procps is there, but uptime was moved to
coreutils-systemd.

Include coreutils-systemd in the default install? I had no idea it had move=
d.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17163066462.bFA4B.19108--


--17163242843.30AEf2.19492
Date: Tue, 21 May 2024 20:44:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224818

            Bug ID: 1224818
           Summary: VUL-0: chromium: multiple vulnerabilities fixed in 125.0.6422.76
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Fixed in chromium 125.0.6422.76:

* CVE-2024-5157: Use after free in Scheduling.
* CVE-2024-5158: Type Confusion in V8
* CVE-2024-5159: Heap buffer overflow in ANGLE
* CVE-2024-5160: Heap buffer overflow in Dawn
* Various fixes from internal audits, fuzzing and other initiatives

https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-des=
ktop_21.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17163242843.30AEf2.19492
Date: Tue, 21 May 2024 20:44:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224818

          Summary
          VUL-0: chromium: multiple vulnerabilities fixed in 125.0.6422=
.76

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Fixed in chromium 125.0.6422.76:

* CVE-2024-5157: Use after free in Scheduling.
* CVE-2024-5158: Type Confusion in V8
* CVE-2024-5159: Heap buffer overflow in ANGLE
* CVE-2024-5160: Heap buffer overflow in Dawn
* Various fixes from internal audits, fuzzing and other initiatives

https://chromereleases.googleblog.com/2024/05/stab=
le-channel-update-for-desktop_21.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17163242843.30AEf2.19492--


body:
--17163301600.A09ecBB.19567
Date: Tue, 21 May 2024 22:22:40 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224822

            Bug ID: 1224822
           Summary: error in permctl manpage
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: suse-beta-at-cboltz.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

My brand-new permctl manpage says (re-formatted for readability)

    EXAMPLES
           permctl --set /usr/share/permissions/permissions=20
                         /usr/share/permissions/permissions.secure

       Parses the files /usr/share/permissions/permissions and
                        /usr/share/permissions/permissions and sets ...

The "Parses the files ..." line mentions the same filename twice. The second
filename should be the *.secure file.

While on it:

           permctl --system /bin/ping

       Run in system mode and only correct permissions of /bin/ping.

You might want to UsrMerge that example to /usr/bin/ping ;-)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17163301600.A09ecBB.19567
Date: Tue, 21 May 2024 22:22:40 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224822

          Summary
          error in permctl manpage

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          suse-beta@cboltz.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

My brand-new permctl manpage says (re-formatted for readabil=
ity)

    EXAMPLES
           permctl --set /usr/share/permissions/permissions=20
                         /usr/share/permissions/permissions.secure

       Parses the files /usr/share/permissions/permissions and
                        /usr/share/permissions/permissions and sets ...

The "Parses the files ..." line mentions the same filename twice.=
 The second
filename should be the *.secure file.

While on it:

           permctl --system /bin/ping

       Run in system mode and only correct permissions of /bin/ping.

You might want to UsrMerge that example to /usr/bin/ping ;-)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17163301600.A09ecBB.19567--

summary: error in permctl manpage


body:
--17163693662.3DAfF8031.20626
Date: Wed, 22 May 2024 09:16:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224869

            Bug ID: 1224869
           Summary: crm_resource command core dumped
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: High Availability
          Assignee: ha-bugs-at-suse.de
          Reporter: xliang-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

crm_resource command core dumped when calling:
# crm_resource --show-metadata stonith:null
Segmentation fault (core dumped)

And the output was in a mess when calling:
# crm_resource --show-metadata stonith:external/sbd
<?xml version=3D"1.0"?>
<resource-agent name=3D"external/sbd">
  <version>1.1</version>
  <longdesc lang=3D"en">
=EF=BF=BD=EF=BF=BD=EF=BF=BDXU
  </longdesc>
  <shortdesc lang=3D"en">g=EF=BF=BD=EF=BF=BD=EF=BF=BDXU</shortdesc>
 =EF=BF=BD~=EF=BF=BD
  <actions>
    <action name=3D"start" timeout=3D"20s" />
    <action name=3D"stop" timeout=3D"15s" />
    <action name=3D"status" timeout=3D"20s" />
    <action name=3D"monitor" timeout=3D"20s" interval=3D"3600s" />
    <action name=3D"meta-data" timeout=3D"15s" />
  </actions>
  <special tag=3D"heartbeat">
    <version>2.0</version>
  </special>
</resource-agent>

Related versions:

# rpm -qa|grep pacemaker
pacemaker-schemas-2.1.7+20240411.81041cf0b-1.1.noarch
pacemaker-libs-2.1.7+20240411.81041cf0b-1.1.x86_64
pacemaker-cli-2.1.7+20240411.81041cf0b-1.1.x86_64
python3-pacemaker-2.1.7+20240411.81041cf0b-1.1.noarch
pacemaker-2.1.7+20240411.81041cf0b-1.1.x86_64
# rpm -qa|grep cluster-glue
cluster-glue-libs-1.0.12+v1.git.1663933145.1619d044-2.3.x86_64
cluster-glue-1.0.12+v1.git.1663933145.1619d044-2.3.x86_64
cluster-glue-devel-1.0.12+v1.git.1663933145.1619d044-2.3.x86_64
# cat /etc/os-release=20
NAME=3D"openSUSE Tumbleweed"
# VERSION=3D"20240423"
ID=3D"opensuse-tumbleweed"
ID_LIKE=3D"opensuse suse"
VERSION_ID=3D"20240423"
PRETTY_NAME=3D"openSUSE Tumbleweed"
ANSI_COLOR=3D"0;32"
# CPE 2.3 format, boo#1217921
CPE_NAME=3D"cpe:2.3:o:opensuse:tumbleweed:20240423:*:*:*:*:*:*:*"
#CPE 2.2 format
#CPE_NAME=3D"cpe:/o:opensuse:tumbleweed:20240423"
BUG_REPORT_URL=3D"https://bugzilla.opensuse.org"
SUPPORT_URL=3D"https://bugs.opensuse.org"
HOME_URL=3D"https://www.opensuse.org"
DOCUMENTATION_URL=3D"https://en.opensuse.org/Portal:Tumbleweed"
LOGO=3D"distributor-logo-Tumbleweed"
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17163693662.3DAfF8031.20626
Date: Wed, 22 May 2024 09:16:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224869

          Summary
          crm_resource command core dumped

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          High Availability

          Assignee
          ha-bugs@suse.de

          Reporter
          xliang@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

crm_resource command core dumped when calling:
# crm_resource --show-metadata stonith:null
Segmentation fault (core dumped)

And the output was in a mess when calling:
# crm_resource --show-metadata stonith:external/sbd
<?xml version=3D"1.0"?>
<resource-agent name=3D"external/sbd">
  <version>1.1</version>
  <longdesc lang=3D"en">
&#x17;=EF=BF=BD=EF=BF=BD=EF=BF=BDXU
  </longdesc>
  <shortdesc lang=3D"en">g=EF=BF=BD=EF=BF=BD=EF=BF=BDXU<=
/shortdesc>
 =EF=BF=BD~=EF=BF=BD
  <actions>
    <action name=3D"start" timeout=3D"20s" />
    <action name=3D"stop" timeout=3D"15s" />
    <action name=3D"status" timeout=3D"20s" />
    <action name=3D"monitor" timeout=3D"20s" interva=
l=3D"3600s" />
    <action name=3D"meta-data" timeout=3D"15s" />
  </actions>
  <special tag=3D"heartbeat">
    <version>2.0</version>
  </special>
</resource-agent>

Related versions:

# rpm -qa|grep pacemaker
pacemaker-schemas-2.1.7+20240411.81041cf0b-1.1.noarch
pacemaker-libs-2.1.7+20240411.81041cf0b-1.1.x86_64
pacemaker-cli-2.1.7+20240411.81041cf0b-1.1.x86_64
python3-pacemaker-2.1.7+20240411.81041cf0b-1.1.noarch
pacemaker-2.1.7+20240411.81041cf0b-1.1.x86_64
# rpm -qa|grep cluster-glue
cluster-glue-libs-1.0.12+v1.git.1663933145.1619d044-2.3.x86_64
cluster-glue-1.0.12+v1.git.1663933145.1619d044-2.3.x86_64
cluster-glue-devel-1.0.12+v1.git.1663933145.1619d044-2.3.x86_64
# cat /etc/os-release=20
NAME=3D"openSUSE Tumbleweed"
# VERSION=3D"20240423"
ID=3D"opensuse-tumbleweed"
ID_LIKE=3D"opensuse suse"
VERSION_ID=3D"20240423"
PRETTY_NAME=3D"openSUSE Tumbleweed"
ANSI_COLOR=3D"0;32"
# CPE 2.3 format, boo#1217921
CPE_NAME=3D"cpe:2.3:o:opensuse:tumbleweed:20240423:*:*:*:*:*:*:*"
#CPE 2.2 format
#CPE_NAME=3D"cpe:/o:opensuse:tumbleweed:20240423"
BUG_REPORT_URL=3D"https://bu=
gzilla.opensuse.org"
SUPPORT_URL=3D"https://bugs.open=
suse.org"
HOME_URL=3D"https://www.opensuse.=
org"
DOCUMENTATION_URL=3D"https://en.opensuse.org/Portal:Tumbleweed"
LOGO=3D"distributor-logo-Tumbleweed"

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17163693662.3DAfF8031.20626--

summary: crm_resource command core dumped


--17163827433.Dd655E4d.21742
Date: Wed, 22 May 2024 12:59:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224995

            Bug ID: 1224995
           Summary: Native Firefox package on Plasma Wayland runs the KDE File Picker under XWayland, not respecting HDPI scaling
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: factory-mozilla-at-lists.opensuse.org
          Reporter: radicalite-at-proton.me
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 875025
  --> https://bugzilla.suse.com/attachment.cgi?id=3D875025&action=3Dedit
Filepicker comparsion between Native Firefox on TW and Flatpak Firefox

When using the file picker from the native Firefox package, the file picker
runs in XWayland, this isn't noticeable on non HiDPI displays unless there'=
s a
HiDPI display connected, or are simply using a HiDPI screen as the only scr=
een,
then this becomes instantly noticeable.=20

This behaviour isn't consistent with applications from the rest of the syst=
em
(moving aside VLC, but the app itself runs entirely under XWayland by
default...), as they run the file picker under Wayland, following the corre=
ct
scaling setting. the Firefox flatpak also runs the file picker under Wayland
correctly (via Portal). This behaviour also doesn't happen with the native
Firefox package on TWGNOME, running the GTK file picker under Wayland with
respect to scaling, so I assume this happens from the OpenSUSE KDE patches
added to Firefox?

Install is a fresh TWKDE install. Comparison in image=20

Operating System: openSUSE Tumbleweed 20240520
KDE Plasma Version: 6.0.4
KDE Frameworks Version: 6.2.0
Qt Version: 6.7.0
Kernel Version: 6.9.1-1-default (64-bit)
Graphics Platform: Wayland
Processors: 4 =C3=97 Intel=C2=AE Core=E2=84=A2 i5-6267U CPU @ 2.90GHz
Memory: 7.6 GiB of RAM
Graphics Processor: Mesa Intel=C2=AE Iris=C2=AE Graphics 550
Manufacturer: Apple Inc.
Product Name: MacBookPro13,2
System Version: 1.0=20

Display config is=20
2560x1600@175%@60hz (Built-in Screen) set to left
1920x1080@100%@120hz (Acer Technologies VG242Y) set to right, set as primary
display.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17163827433.Dd655E4d.21742
Date: Wed, 22 May 2024 12:59:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224995

          Summary
          Native Firefox package on Plasma Wayland runs the KDE File Pi=
cker under XWayland, not respecting HDPI scaling

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Firefox

          Assignee
          factory-mozilla@lists.opensuse.org

          Reporter
          radicalite@proton.me

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 875025 [details]
Filepicker comparsion between Native Firefox on TW and Flatpak Firefox

When using the file picker from the native Firefox package, the file picker
runs in XWayland, this isn't noticeable on non HiDPI displays unless there'=
s a
HiDPI display connected, or are simply using a HiDPI screen as the only scr=
een,
then this becomes instantly noticeable.=20

This behaviour isn't consistent with applications from the rest of the syst=
em
(moving aside VLC, but the app itself runs entirely under XWayland by
default...), as they run the file picker under Wayland, following the corre=
ct
scaling setting. the Firefox flatpak also runs the file picker under Wayland
correctly (via Portal). This behaviour also doesn't happen with the native
Firefox package on TWGNOME, running the GTK file picker under Wayland with
respect to scaling, so I assume this happens from the OpenSUSE KDE patches
added to Firefox?

Install is a fresh TWKDE install. Comparison in image=20

Operating System: openSUSE Tumbleweed 20240520
KDE Plasma Version: 6.0.4
KDE Frameworks Version: 6.2.0
Qt Version: 6.7.0
Kernel Version: 6.9.1-1-default (64-bit)
Graphics Platform: Wayland
Processors: 4 =C3=97 Intel=C2=AE Core=E2=84=A2 i5-6267U CPU @ 2.90GHz
Memory: 7.6 GiB of RAM
Graphics Processor: Mesa Intel=C2=AE Iris=C2=AE Graphics 550
Manufacturer: Apple Inc.
Product Name: MacBookPro13,2
System Version: 1.0=20

Display config is=20
2560x1600@175%@60hz (Built-in Screen) set to left
1920x1080@100%@120hz (Acer Technologies VG242Y) set to right, set a=
s primary
display.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17163827433.Dd655E4d.21742--


body:
Gecko/20100101
Firefox/126.0
Build Identifier:=20

Randomly get hard lockups with no errors or dmesg logs, can't ssh into the
system either.

Reproducible: Always

Steps to Reproduce:
1. Record the screen with vaapi encoding on amdgpu
Actual Results:=20=20
Kernel hard lockup some time after 5-30 minutes

Expected Results:=20=20
System should be stable

With i5-13600k and RX 6600 XT.

I'm running sway and the screen recording tool doesn't matter as long as it=
's
using vaapi encoding. The Mesa version also doesn't matter.

This happens on Kernel versions 6.7 or newer, I just tried 6.9.1 and can
reproduce it there as well. It does not happen on 6.6.x. I'm currently runn=
ing
6.6.31-lts.

I'd go ahead and bisect the kernel but I'm not sure how to build and install
the kernel in a way that it appears in the grub menu.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17164725861.a3fDA6.25210--

summary: Kernel hard lockup under mild GPU load


body:
--17165431482.0D1542bF3.27594
Date: Fri, 24 May 2024 09:32:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1225197

            Bug ID: 1225197
           Summary: util-linux depends on libmagic
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: sbrabec-at-suse.com
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: bci-internal-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

util-linux has a hard dependency on libmagic1 and thus file-magic, which is
rather big (~9MiB). It's only pulled in because /usr/bin/more links against=
 it.

Can this dependency be avoided for instance by removing libmagic support fr=
om
more? That's what Debian, Fedora and Ubuntu do as well.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17165431482.0D1542bF3.27594
Date: Fri, 24 May 2024 09:32:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1225197

          Summary
          util-linux depends on libmagic

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          sbrabec@suse.com

          Reporter
          fvogt@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          bci-internal@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

util-linux has a hard dependency on libmagic1 and thus file-=
magic, which is
rather big (~9MiB). It's only pulled in because /usr/bin/more links against=
 it.

Can this dependency be avoided for instance by removing libmagic support fr=
om
more? That's what Debian, Fedora and Ubuntu do as well.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17165431482.0D1542bF3.27594--

summary: util-linux depends on libmagic


--17165435441.CCB51D858.27618
Date: Fri, 24 May 2024 09:39:04 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1225199

            Bug ID: 1225199
           Summary: VUL-0: CVE-2024-5274: chromium: Type Confusion in V8 fixed in CVE-2024-5274
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-des=
ktop_23.html

Fixed in 125.0.6422.112:

High CVE-2024-5274: Type Confusion in V8. Reported by Cl=C3=A9ment Lecigne =
of
Google's Threat Analysis Group and Brendon Tiszka of Chrome Security on
2024-05-20

Google is aware that an exploit for CVE-2024-5274 exists in the wild.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17165435441.CCB51D858.27618
Date: Fri, 24 May 2024 09:39:04 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1225199

          Summary
          VUL-0: CVE-2024-5274: chromium: Type Confusion in V8 fixed in=
 CVE-2024-5274

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2024/05/stable-channel-update-for-desktop_23.html

Fixed in 125.0.6422.112:

High CVE-2024-5274: Type Confusion in V8. Reported by Cl=C3=A9ment Lecigne =
of
Google's Threat Analysis Group and Brendon Tiszka of Chrome Security on
2024-05-20

Google is aware that an exploit for CVE-2024-5274 exists in the wild.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17165435441.CCB51D858.27618--


--17165871683.92ea4E9.29747
Date: Fri, 24 May 2024 21:46:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1225278

            Bug ID: 1225278
           Summary: Firefox's Search Provider doesn't work on GNOME (and possibly other DEs)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Firefox
          Assignee: factory-mozilla-at-lists.opensuse.org
          Reporter: ant.romano-at-pm.me
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I'm using openSUSE Tumbleweed w/ snapshot 20240523, Firefox 126.0 (.rpm) and
GNOME 46.1.

On Firefox, the `browser.gnome-search-provider.enabled` parameter is set to
true, while "Firefox" is listed as an enabled search provider on GNOME
(Settings -> Search). The "GNOME shell integration" extension is also enabl=
ed,
although I'm not sure it is required.=20

Despite my premises, Firefox simply does not appear as a search provider wh=
en
trying to search through GNOME.=20

I've tried searching for solutions or at least for people with the same iss=
ue
and found out this article from a Fedora:
https://mastransky.wordpress.com/2023/10/13/q3-firefox-linux-update/ althou=
gh I
have no idea how to correctly follow the steps he described. I can only sta=
te
that the Mozilla Firefox Search Provider service indeed is _not_ "Activatab=
le".
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17165871683.92ea4E9.29747
Date: Fri, 24 May 2024 21:46:08 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1225278

          Summary
          Firefox's Search Provider doesn't work on GNOME (and possibly=
 other DEs)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Minor

          Priority
          P5 - None

          Component
          Firefox

          Assignee
          factory-mozilla@lists.opensuse.org

          Reporter
          ant.romano@pm.me

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I'm using openSUSE Tumbleweed w/ snapshot 20240523, Firefox =
126.0 (.rpm) and
GNOME 46.1.

On Firefox, the `browser.gnome-search-provider.enabled` parameter is set to
true, while "Firefox" is listed as an enabled search provider on =
GNOME
(Settings -> Search). The "GNOME shell integration" extension =
is also enabled,
although I'm not sure it is required.=20

Despite my premises, Firefox simply does not appear as a search provider wh=
en
trying to search through GNOME.=20

I've tried searching for solutions or at least for people with the same iss=
ue
and found out this article from a Fedora:
https://mastransky.wordpress.com/2023/10/13/q3-firefox-linux-update/<=
/a> although I
have no idea how to correctly follow the steps he described. I can only sta=
te
that the Mozilla Firefox Search Provider service indeed is _not_ "Acti=
vatable".

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17165871683.92ea4E9.29747--


--17166916173.FeBDe752.30061
Date: Sun, 26 May 2024 02:46:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1225290

            Bug ID: 1225290
           Summary: pam-config: pam_fscrypt in wrong priority
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: joseskvolpe-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

pam_fscrypt.so must be set to execute before any module that requires the u=
ser
home dir to be mounted, but some modules are found to execute before it.

I'm using Tumbleweeb with the basic KDE packages. After setting-up fscrypt =
with
PAM, i found out it's module is not inserted by pam-config in a proper orde=
r.
In my context, pam_kwallet5.so is set to run before pam_fscryt.so, as resul=
t,
kwallet asks me for a password upon login. Editing /etc/pam.d/common-sessio=
n to
change the orders is a workaround, but i have to modify it every system upd=
ate.

The original file is found as:
(...)
session optional     pam_kwallet5.so
session optional     pam_fscrypt.so
(...)

It should be:
(...)
session optional     pam_fscrypt.so
session optional     pam_kwallet5.so
(...)

EXPECTED RESULTS: The user home directory must be unlocked by fscrypt before
running kwallet5 and any other PAM modules that requires the directory to be
accessible. This configuration must be automatically set by pam-config.

CURRENT RESULTS: SystemD attempts to execute kwallet5 and other modules bef=
ore
unlocking the needed user directory as the configuration defined by pam-con=
fig.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17166916173.FeBDe752.30061
Date: Sun, 26 May 2024 02:46:57 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1225290

          Summary
          pam-config: pam_fscrypt in wrong priority

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          joseskvolpe@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

pam_fscrypt.so must be set to execute before any module that=
 requires the user
home dir to be mounted, but some modules are found to execute before it.

I'm using Tumbleweeb with the basic KDE packages. After setting-up fscrypt =
with
PAM, i found out it's module is not inserted by pam-config in a proper orde=
r.
In my context, pam_kwallet5.so is set to run before pam_fscryt.so, as resul=
t,
kwallet asks me for a password upon login. Editing /etc/pam.d/common-sessio=
n to
change the orders is a workaround, but i have to modify it every system upd=
ate.

The original file is found as:
(...)
session optional     pam_kwallet5.so
session optional     pam_fscrypt.so
(...)

It should be:
(...)
session optional     pam_fscrypt.so
session optional     pam_kwallet5.so
(...)

EXPECTED RESULTS: The user home directory must be unlocked by fscrypt before
running kwallet5 and any other PAM modules that requires the directory to be
accessible. This configuration must be automatically set by pam-config.

CURRENT RESULTS: SystemD attempts to execute kwallet5 and other modules bef=
ore
unlocking the needed user directory as the configuration defined by pam-con=
fig.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17166916173.FeBDe752.30061--


--17168005151.Ccab5cd6.31248
Date: Mon, 27 May 2024 09:01:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1225317

            Bug ID: 1225317
           Summary: AUDIT-0: systemd: Please review the new DBUS /polkit stuff brought by v256
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fbui-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hello,

The next major version of system (v256) will come with a host of new featur=
es
and thus a bunch of methods/actions to review.

Could you please review them ?

I created the following project that will be used as the devel project for
v256:
https://build.opensuse.org/package/live_build_log/home:fbui:systemd:v256/sy=
stemd/openSUSE_Factory/x86_64

You should find the build logs there where the list of methods/actions to
review is detailed.

Please note that the integration is still WIP hence most of the new stuff h=
as
been temporarily packaged in the systemd-experimental subpackage. But some =
of
them will be moved in different subpackages once the integration will be
finished.

Thanks in advance.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17168005151.Ccab5cd6.31248
Date: Mon, 27 May 2024 09:01:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1225317

          Summary
          AUDIT-0: systemd: Please review the new DBUS /polkit stuff br=
ought by v256

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          fbui@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hello,

The next major version of system (v256) will come with a host of new featur=
es
and thus a bunch of methods/actions to review.

Could you please review them ?

I created the following project that will be used as the devel project for
v256:
https://build.opensuse.org/packag=
e/live_build_log/home:fbui:systemd:v256/systemd/openSUSE_Factory/x86_64

You should find the build logs there where the list of methods/actions to
review is detailed.

Please note that the integration is still WIP hence most of the new stuff h=
as
been temporarily packaged in the systemd-experimental subpackage. But some =
of
them will be moved in different subpackages once the integration will be
finished.

Thanks in advance.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17168005151.Ccab5cd6.31248--


--17168236093.D4d24.32711
Date: Mon, 27 May 2024 15:26:49 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1225397

            Bug ID: 1225397
           Summary: postfix gives warnings about deprecated parameters
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: freek-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

postfix gives warnings about deprecated parameters
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtp_enforce_tls" wil=
l be
removed; instead, specify "smtp_tls_security_level"
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtpd_enforce_tls" wi=
ll
be removed; instead, specify "smtpd_tls_security_level"
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtp_use_tls" will be
removed; instead, specify "smtp_tls_security_level"
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtpd_use_tls" will be
removed; instead, specify "smtpd_tls_security_level"

These parameters are introduced in /sbin/config.postfix

The attached patch file removes this introduction, the replacements are alr=
eady
present in config.postfix.
Also a bug in the naming of backups in /var/adm/backups/postfix is addresse=
d.

In principle "$POSTFIX_SMTP_TLS_CLIENT" =3D=3D "must" should not be expande=
d in
$PCONF -e "smtp_tls_security_level =3D encrypt". This is a global definitio=
n. It
should be expanded in smtp_tls_policy_maps =3D lmdb:/etc/postfix/tls_policy=
 and
only for specific destinations in /etc/postfix/tls_policy.
So the possibility "must" should be accompanied by specific destinations.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17168236093.D4d24.32711
Date: Mon, 27 May 2024 15:26:49 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1225397

          Summary
          postfix gives warnings about deprecated parameters

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Network

          Assignee
          screening-team-bugs@suse.de

          Reporter
          freek@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

postfix gives warnings about deprecated parameters
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtp_enforce_tls=
" will be
removed; instead, specify "smtp_tls_security_level"
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtpd_enforce_tl=
s" will
be removed; instead, specify "smtpd_tls_security_level"
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtp_use_tls&quo=
t; will be
removed; instead, specify "smtp_tls_security_level"
May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf:
warning: /etc/postfix/main.cf: support for parameter "smtpd_use_tls&qu=
ot; will be
removed; instead, specify "smtpd_tls_security_level"

These parameters are introduced in /sbin/config.postfix

The attached patch file removes this introduction, the replacements are alr=
eady
present in config.postfix.
Also a bug in the naming of backups in /var/adm/backups/postfix is addresse=
d.

In principle "$POSTFIX_SMTP_TLS_CLIENT" =3D=3D "must" s=
hould not be expanded in
$PCONF -e "smtp_tls_security_level =3D encrypt". This is a global=
 definition. It
should be expanded in smtp_tls_policy_maps =3D lmdb:/etc/postfix/tls_policy=
 and
only for specific destinations in /etc/postfix/tls_policy.
So the possibility "must" should be accompanied by specific desti=
nations.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17168236093.D4d24.32711--