--1620204458.c384b80.32535
Date: Wed, 5 May 2021 08:47:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185637

            Bug ID: 1185637
           Summary: openssl-1_1 fails to build after 2022-06-01
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: pmonrealgonzalez-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: jsikes-at-suse.com
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
our openssl-1_1/openssl-1.1.1k fails tests after 2022-06-01

Likely reason is one or more of these expiring certs:

for cert in `find test -name \*pem` ; do openssl x509 -text < $cert |
  grep After |grep 2022 && echo $cert ; done 2>&1 |grep -A1 2022
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/D1_Issuer_ICA.pem
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/ISIC_D1_Issuer_ICA.pem
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/WSNIC_D1_Issuer_ICA.pem
            Not After : Apr 13 10:00:00 2022 GMT
test/ocsp-tests/WKIC_D1_Issuer_ICA.pem
            Not After : Jun  1 00:00:00 2022 GMT
test/certs/embeddedSCTs1_issuer.pem
            Not After : Jun  1 00:00:00 2022 GMT
test/certs/embeddedSCTs1.pem

building further in the future might have more failing tests:

 Test Summary Report
 -------------------
 ../test/recipes/80-test_cms.t                    (Wstat: 1280 Tests: 6 Failed:
5)
   Failed tests:  1-5
   Non-zero exit status: 5
 ../test/recipes/80-test_ssl_new.t                (Wstat: 256 Tests: 29 Failed:
1)
   Failed test:  12
   Non-zero exit status: 1
 Files=160, Tests=1893, 86 wallclock secs ( 1.22 usr  0.11 sys + 71.76 cusr
7.53 csys = 80.62 CPU)
 Result: FAIL

Steps to Reproduce:
osc co openSUSE:Factory/openssl-1_1 && cd $_
osc build --vm-type=kvm --noservice --clean --build-opt=--vm-custom-opt="-rtc
base=2022-06-02T00:00:00"

once that issue is fixed, try with 2028 and 2036

SUSE:SLE-15-SP2:GA/openssl-1_1 is also affected.
Likely affects other enterprise codestreams as well.


--1620204783.D2F1fa0.10687
Date: Wed, 5 May 2021 08:53:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185638

            Bug ID: 1185638
           Summary: gdb: debugging guix (and maybe other programs?) results in 100% CPU loop in gdb
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: matz-at-suse.com
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: tdevries-at-suse.com
          Found By: ---
           Blocker: ---

In recent Tumbleweed snapshots debugging with gdb has become unreliable. Maybe
partly related to bug 1184214 or to the debuginfod feature but I cannot be
sure.

On the current Tumbleweed snapshot (20210503) I can reproduce a problem with
the guix package:

```
zypper in guix guix-debuginfo
systemctl start guix-daemon
gdb -p `pidof guix-daemon`
```

After downloading of some additional debuginfos this ends in a 100 % CPU loop.
It is only possible to kill is with SIGKILL. The last output to stdout is:

```
Using host libthread_db library "/lib64/libthread_db.so.1".
```

Attaching to the looping `gdb? process shows the following backtrace:

```
    at ../../gdb/dwarf2/read.c:21781
    at ../../gdb/dwarf2/read.c:13556
    at ../../gdb/dwarf2/read.c:13684
    at ../../gdb/dwarf2/read.c:13679
    at ../../gdb/dwarf2/read.c:9958
    (per_cu=<optimized out>, per_objfile=0x55f3fc0e8100,
skip_partial=<optimized out>)
    at ../../gdb/dwarf2/read.c:2440
    per_cu=<optimized out>) at ../../gdb/dwarf2/read.h:598
    at ../../gdb/dwarf2/read.c:9055
    at ../../gdb/psymtab.c:766
    pc=<optimized out>, section=<optimized out>, warn_if_readin=1) at
../../gdb/psymtab.c:394
--Type <RET> for more, q to quit, c to continue without paging--

    at ../../gdb/top.c:102
    at /usr/include/c++/10/bits/std_function.h:622
    args=<optimized out>) at ../../gdb/infcmd.c:2516
```

On Leap 15.2 the problem cannot be reproduced.


body:
--1620223344.f5C552e0.15913
Date: Wed, 5 May 2021 14:02:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185657

            Bug ID: 1185657
           Summary: [Tracker] Packages installing rpm macro files to /etc/rpm instead of /usr/lib/rpm/macros.d
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

RPM reads its macro definitions from various places

Packages are supposed to install their data to /usr/lib/rpm/macros.d
A few legacy packages still use /etc/rpm for this though.

Changing the location is in line with the goal of an empty /etc to reset a
system state

pkgs: mk-configure strip-nondeterminism


--1620223660.4384A0.21702
Date: Wed, 5 May 2021 14:07:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185660

            Bug ID: 1185660
           Summary: lua-lmod: rpm macro file installed to /etc/rpm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package lua-lmod installs a file

/etc/rpm/macros.lmod

RPM packages though are supposed to install their macro files to
/usr/lib/rpm/macros.d (use the variable %{_rpmmacrodir})

This in order to further work towards the goal of 'empty /etc' for a default
setup.


--1620223742.efDEAeE0.18296
Date: Wed, 5 May 2021 14:09:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185661

            Bug ID: 1185661
           Summary: libpng16-tools: rpm macro file installed to /etc/rpm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package libpng16-tools installs a file

/etc/rpm/macros.libpng-tools

RPM packages though are supposed to install their macro files to
/usr/lib/rpm/macros.d (use the variable %{_rpmmacrodir})

This in order to further work towards the goal of 'empty /etc' for a default
setup


--1620223801.70bB71af4.18296
Date: Wed, 5 May 2021 14:10:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185662

            Bug ID: 1185662
           Summary: tcl: rpm macro file installed to /etc/rpm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package tcl installs a file

/etc/rpm/macros.tcl

RPM packages though are supposed to install their macro files to
/usr/lib/rpm/macros.d (use the variable %{_rpmmacrodir})

This in order to further work towards the goal of 'empty /etc' for a default
setup.


--1620223972.45B2F0.23470
Date: Wed, 5 May 2021 14:12:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185664

            Bug ID: 1185664
           Summary: optipng: rpm macro file installed to /etc/rpm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package optipng installs a file

/etc/rpm/macros.optipng

RPM packages though are supposed to install their macro files to
/usr/lib/rpm/macros.d (use the variable %{_rpmmacrodir})

This in order to further work towards the goal of 'empty /etc' for a default
setup.


--1620224037.C2257Ca0.19476
Date: Wed, 5 May 2021 14:13:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185665

            Bug ID: 1185665
           Summary: ooRexx: rpm macro file installed to /etc/rpm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package ooRexx installs a file

/etc/rpm/macros.rexx

RPM packages though are supposed to install their macro files to
/usr/lib/rpm/macros.d (use the variable %{_rpmmacrodir})

This in order to further work towards the goal of 'empty /etc' for a default
setup.


--1620224095.17428A450.23684
Date: Wed, 5 May 2021 14:14:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185666

            Bug ID: 1185666
           Summary: ffcall: rpm macro file installed to /etc/rpm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package ffcall installs a file

/etc/rpm/macros.ffcall

RPM packages though are supposed to install their macro files to
/usr/lib/rpm/macros.d (use the variable %{_rpmmacrodir})

This in order to further work towards the goal of 'empty /etc' for a default
setup.


body:
--1620298517.0ab214130.26223
Date: Thu, 6 May 2021 10:55:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185712

            Bug ID: 1185712
           Summary: cross-arm-binutils missing symlinks
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: alinm.elena-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

cross-arm-binutils
seems to provide arm-none-eabi-* utils vis symlinks to arm-suse- equivalents.
see below.

in the process of building qmk for arm I noticed arm-none-eabi-size is missing.

lrwxrwxrwx 1 root root   28 Mar 26 11:26 /usr/bin/arm-none-eabi-strip ->
arm-suse-linux-gnueabi-strip
lrwxrwxrwx 1 root root   30 Mar 26 11:26 /usr/bin/arm-none-eabi-readelf ->
arm-suse-linux-gnueabi-readelf
lrwxrwxrwx 1 root root   29 Mar 26 11:26 /usr/bin/arm-none-eabi-ranlib ->
arm-suse-linux-gnueabi-ranlib
lrwxrwxrwx 1 root root   30 Mar 26 11:26 /usr/bin/arm-none-eabi-objdump ->
arm-suse-linux-gnueabi-objdump
lrwxrwxrwx 1 root root   30 Mar 26 11:26 /usr/bin/arm-none-eabi-objcopy ->
arm-suse-linux-gnueabi-objcopy
lrwxrwxrwx 1 root root   25 Mar 26 11:26 /usr/bin/arm-none-eabi-nm ->
arm-suse-linux-gnueabi-nm
lrwxrwxrwx 1 root root   29 Mar 26 11:26 /usr/bin/arm-none-eabi-ld.bfd ->
arm-suse-linux-gnueabi-ld.bfd
lrwxrwxrwx 1 root root   25 Mar 26 11:26 /usr/bin/arm-none-eabi-ld ->
arm-suse-linux-gnueabi-ld
lrwxrwxrwx 1 root root   25 Mar 26 11:26 /usr/bin/arm-none-eabi-as ->
arm-suse-linux-gnueabi-as
lrwxrwxrwx 1 root root   25 Mar 26 11:26 /usr/bin/arm-none-eabi-ar ->
arm-suse-linux-gnueabi-ar

summary: cross-arm-binutils missing symlinks


body:
--1620302985.bD2A20.6974
Date: Thu, 6 May 2021 12:09:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185716

            Bug ID: 1185716
           Summary: chromium fails to build with GCC11
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: rguenther-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

As can be seen in

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/chromium/standard/x86_64

chromium FTBFS.

[  397s] ../../third_party/ruy/src/ruy/block_map.cc: In function 'void
ruy::Make
BlockMap(int, int, int, int, int, int, int, int, const ruy::CpuCacheParams&,
ruy
::BlockMap*)':
[  397s] ../../third_party/ruy/src/ruy/block_map.cc:375:25: error:
'numeric_limits' is not a member of 'std'
[  397s]   375 |   int best_score = std::numeric_limits<int>::min();
[  397s]       |                         ^~~~~~~~~~~~~~
[  397s] ../../third_party/ruy/src/ruy/block_map.cc:375:40: error: expected
primary-expression before 'int'
[  397s]   375 |   int best_score = std::numeric_limits<int>::min();
[  397s]       |                                        ^~~

there seems to be a missing #include in this file.

summary: chromium fails to build with GCC11


--1620313245.3EE4fEE0.32067
Date: Thu, 6 May 2021 15:00:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185730

            Bug ID: 1185730
           Summary: VUL-0: CVE-2021-29478: redis: Integer overflow via COPY command for large intsets
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/283437/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: jzerebecki-at-suse.com
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: smash_bz-at-suse.de
        Depends on: 1185728
          Found By: Security Response Team
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1185728 +++

CVE-2021-29478

Redis is an open source (BSD licensed), in-memory data structure store, used as
a database, cache, and message broker. An integer overflow bug in Redis 6.2
before 6.2.3 could be exploited to corrupt the heap and potentially result with
remote code execution. Redis 6.0 and earlier are not directly affected by this
issue. The problem is fixed in version 6.2.3. An additional workaround to
mitigate the problem without patching the `redis-server` executable is to
prevent users from modifying the `set-max-intset-entries` configuration
parameter. This can be done using ACL to restrict unprivileged users from using
the `CONFIG SET` command.

References:

https://github.com/redis/redis/security/advisories/GHSA-qh52-crrg-44g3
https://redis.io/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1957414
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-29478
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29478
https://github.com/redis/redis/security/advisories/GHSA-qh52-crrg-44g3
https://redis.io/


--1620325196.185a0.17524
Date: Thu, 6 May 2021 18:19:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185739

            Bug ID: 1185739
           Summary: USB drive is not mounted automatically in the environment
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Xfce
          Assignee: bnc-team-xfce-at-forge.provo.novell.com
          Reporter: betanux-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 849115
  --> http://bugzilla.opensuse.org/attachment.cgi?id=849115&action=edit
lsusb -v shows the dives

the USB drives connected to the Pi4 are not automatically mounted in the
environment. see joined the lsusb -v and lsusb. and a picture of the journal.
The usb is listed in lsusb but is not mounted. Tested with the xfce desktop and
also the LXQT desktop too, it is the same problem.


--1620341191.C1e111.29959
Date: Thu, 6 May 2021 22:46:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185748

            Bug ID: 1185748
           Summary: Error updating python2-pytz from Leap 15.2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Upgrade Problems
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jgonzalez-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Updating with zypper dup (all repositories except the official from openSUSE
disabled):

(1206/6904) Installing: python2-pytz-2020.5-1.10.noarch
................................................................................................................................................................................................................[error]
Installation of python2-pytz-2020.5-1.10.noarch failed:
Error: Subprocess failed. Error: RPM failed: error: unpacking of archive failed
on file /usr/lib/python2.7/site-packages/pytz/zoneinfo: cpio: File from package
already exists as a directory in system
error: python2-pytz-2020.5-1.10.noarch: install failed
error: python2-pytz-2019.1-lp152.3.3.1.noarch: erase skipped
Abort, retry, ignore? [a/r/i] (a): r

As I wanted to complete the installation to be able to work tomorrow, I just
removed the directory /usr/lib/python2.7/site-packages/pytz/zoneinfo (including
contents), hit `r` for retry, and the dup continued just fine for now.

I verified /usr/lib/python2.7/site-packages/pytz/zoneinfo is created again and
owned by python2-pytz-2020.5-1.10.noarch (package comes from
http://download.opensuse.org/distribution/leap/15.3/repo/oss/), and of course
python2-pytz-2019.1-lp152.3.3.1.noarch was removed.


--1620379754.1Db0a1.16258
Date: Fri, 7 May 2021 09:29:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185766

            Bug ID: 1185766
           Summary: Transacrional-update fails due to selinux
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE MicroOS
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: MicroOS
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: gm.venekamp-at-quicknet.nl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When doing a fresh install with today's current MicroOS image (0505) and with
the MicroOS transactiona container pattern, installing additional packages
after the initial install fail. For example:

# transactional-update pkg install --download-in-advance firewalld
...
Additional rpm output:
/sbin/ldconfig: Warning: ignoring configuration file that cannot be opened:
/etc/ld.so.conf: Permission denied
/sbin/ldconfig: Can't create temporary cache file /etc/ld.so.cache.xeizJJ:
Permission
denied
warning: %post(libgirepository-1_0-1-1.68.0-1.2.x86_64) scriptlet failed, exit
status 1

There are multiple messages like this.

However, when I disable selinux by:

setenforce 0

The install succeeds.

Disabling selinux as a workaroud for installing a few additional packages to
the MicroOS container works as long as this is done manually. However, for
automated updates, one would have to permanently disable selinux, which I don't
thinks is a good idea.

Not sure if the following is related. During initial boot of the installed
systemd complains about the following role:

system_u_system_r_init_t

Regards,
Gerben


--1620580231.21a030.24955
Date: Sun, 9 May 2021 17:10:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185807

            Bug ID: 1185807
           Summary: 'rpm -V udev' reports /usr/lib/udev/compat-symlink-generation as modified
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: systemd-maintainers-at-suse.de
          Reporter: suse-beta-at-cboltz.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

# rpm -V udev
.M.......  g /usr/lib/udev/compat-symlink-generation

The file is packaged as empty and with 000 permissions:
# rpm -qlv udev | grep compat-symlink-generation
--------


--1620642304.F1afdF60.11983
Date: Mon, 10 May 2021 10:25:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185839

            Bug ID: 1185839
           Summary: [Build 20210508] openvswitch-pki: calls openssl without specifying a dependency
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/1734303/modules/ovs_
                    server/steps/77
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-ovs-server@64bit fails
in
[ovs_server](https://openqa.opensuse.org/tests/1734303/modules/ovs_server/steps/77)

This error is being exposed as ca-certificates no longer relies on openssl cli
tools, which in turn means openssl is no longer installed on all systems.

ovs-pki (openvswitch-pki) calls out to openssl, but there is no dependency on
openssl(cli)

## Test suite description
Regression test for openvswitch-ipsec. Maintainer: Anna Minou

## Reproducible

Fails since (at least) Build
[20210508](https://openqa.opensuse.org/tests/1734078)

## Expected result

Last good: [20210507](https://openqa.opensuse.org/tests/1731392) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=ovs-server&version=Tumbleweed)


--1620661520.CC7b1.19831
Date: Mon, 10 May 2021 15:45:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185874

            Bug ID: 1185874
           Summary: VUL-1: CVE-2021-28899: live555: Vulnerability in the Networks LIVE555 Streaming Media before 2021.3.16
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/283184/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Sound
          Assignee: davejplater-at-gmail.com
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-28899

Vulnerability in the AC3AudioFileServerMediaSubsession,
ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive
OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media
before 2021.3.16.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28899
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28899
http://lists.live555.com/pipermail/live-devel/2021-March/021891.html


--1620721896.E75Ad630.31876
Date: Tue, 11 May 2021 08:31:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185891

            Bug ID: 1185891
           Summary: KStars crashes on Leap due to missing dependency
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: pstivanin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

KStars crashes on Leap 15.3 due to a missing runtime dep
(libqt5-qtquickcontrols). It works fine on Tumbleweed, because this dep is
installed by something else (I tried a clean XFCE TW installation from latest
snapshot)

How to reproduce on Leap:

- install Leap 15.3 with XFCE from latest snapshot available
- install kstars (zypper in kstars)
- start EKOS (CTRL+K)
- start the Simulators profile => Kstars crashes

Looking at the terminal, we can see that KStars is complaining about a missing
runtime dep:

...
qrc:/qml/mount/mountbox.qml:2:1: module "QtQuick.Controls" is not installed
qrc:/qml/mount/mountbox.qml:4:1: module "QtQuick.Controls.Styles" is not
installed
...

After the missing dep is installed (zypper in libqt5-qtquickcontrols), KStars
and EKOS run fine.

I'm working right now on an SR for Factory and a MR for Leap 15.3.


--1620730844.0cccD0.17408
Date: Tue, 11 May 2021 11:00:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185908

            Bug ID: 1185908
           Summary: VUL-0: chromium: multiple security issues fixed in 90.0.4430.212
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html

CVE-2021-30506: Incorrect security UI in Web App Installs
CVE-2021-30507: Inappropriate implementation in Offline
CVE-2021-30508: Heap buffer overflow in Media Feeds
CVE-2021-30509: Out of bounds write in Tab Strip
CVE-2021-30510: Race in Aura
CVE-2021-30511: Out of bounds read in Tab Group
CVE-2021-30512: Use after free in Notifications
CVE-2021-30513: Type Confusion in V8
CVE-2021-30514: Use after free in Autofill
CVE-2021-30515: Use after free in File API
CVE-2021-30516: Heap buffer overflow in History
CVE-2021-30517: Type Confusion in V8
CVE-2021-30518: Heap buffer overflow in Reader Mode
CVE-2021-30519: Use after free in Payments
CVE-2021-30520: Use after free in Tab Strip


--1620752600.6Ac2d38d13.9294
Date: Tue, 11 May 2021 17:03:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185931

            Bug ID: 1185931
           Summary: libsrtp2-devel effectively depends on libopenssl-devel without Require'ing it
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: opensuse-at-larma.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

libsrtp2.pc as shipped with libsrtp2-devel requests a linker flag -lcrypto and
thus requires libcrypto.so to be present, which is provided as part of
libopenssl-devel. However libsrtp2-devel has no dependency on libopenssl-devel.

Either the -lcrypto flag is actually not needed or Require: libopenssl-devel
(or similar) should be added to libsrtp2-devel.


--1620773994.cF3c80.3123
Date: Tue, 11 May 2021 22:59:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185940

            Bug ID: 1185940
           Summary: Java:packages/rabbitmq-java-client: Version 5.12 available
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: pmonrealgonzalez-at-suse.com
          Reporter: rpm-at-fthiessen.de
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The current version if from 3.x series, which is quite old.
The current series is 5.x (current release 5.12:
https://www.rabbitmq.com/java-client.html ) and even the legacy series is 4.x

Please consider an update.


body:
--1620774261.1fA1380.3703
Date: Tue, 11 May 2021 23:04:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185941

            Bug ID: 1185941
           Summary: texlive-prosper stopped working
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: hpcoder-at-hpcoders.com.au
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 849276
  --> http://bugzilla.opensuse.org/attachment.cgi?id=849276&action=edit
LaTeX file exhibiting the bug.

Compiling a prosper document fails with:

! Extra \endgroup.
\document ->\endgroup
                      \the \before@document \begingroup \UseOneTimeHook {beg...
l.12 \begin{document}

To reproduce, type: "latex classdesc-preso.tex" (see attached).

Tumbleweed Version with bug present: 20210505
Tumbleweed Version without the bug:  20210417

pkgs: texlive-specs-a texlive-specs-b texlive-specs-c texlive-specs-d texlive-specs-e texlive-specs-f texlive-specs-g texlive-specs-h texlive-specs-i texlive-specs-j texlive-specs-k texlive-specs-l texlive-specs-m texlive-specs-n texlive-specs-o texlive-specs-p texlive-specs-q texlive-specs-r texlive-specs-s texlive-specs-t texlive-specs-u texlive-specs-v texlive-specs-w texlive-specs-x texlive-specs-y texlive-specs-z

summary: texlive-prosper stopped working


--1620807419.BbA4fd0.11753
Date: Wed, 12 May 2021 08:16:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185952

            Bug ID: 1185952
           Summary: [Build 20210510] PostgreSQL is not startable on s390x
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: S/390-64
               URL: https://openqa.opensuse.org/tests/1734657/modules/post
                    gresql_server/steps/6
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ada.lovelace-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-s390x-textmode@s390x-zVM-vswitch-l2 fails in
[postgresql_server](https://openqa.opensuse.org/tests/1734657/modules/postgresql_server/steps/6)
All packages can be installed. The problem is that the PostgreSQL server can
not be started. The journal log is saying:


body:
--1620810691.efa206F0.19614
Date: Wed, 12 May 2021 09:11:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185958

            Bug ID: 1185958
           Summary: udev<>systemd dependency loop
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: systemd-maintainers-at-suse.de
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

rpm -Fvh *
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:udev-248.2-0                     ################################# [  6%]
/usr/bin/udevadm: error while loading shared libraries:
libsystemd-shared-248.so: cannot open shared object file: No such file or
directory
   2:systemd-248.2-0                  ################################# [ 13%]

udevadm as called in udev's %post requires libsystemd-shared-248.so which is in
the systemd package. systemd on the other hand requires udev. So an ordering
issue.

Does systemd actually have to require udev? Suppose it's not strictly required
eg for nspawn containers?

summary: udev<>systemd dependency loop


--1620827429.8daC41.18347
Date: Wed, 12 May 2021 13:50:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185975

            Bug ID: 1185975
           Summary: VUL-0: CVE-2020-28600: openscad: a specially crafted STL file can lead to code execution via out-of-bounds write in import_stl.cc:import_stl()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/283908/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: smar-at-smar.fi
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-28600

An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl()
functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file
can lead to code execution. An attacker can provide a malicious file to trigger
this vulnerability.

External Reference:

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1224

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1959716
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28600
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28600
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1224


--1620912078.C4Eb36B0.7449
Date: Thu, 13 May 2021 13:21:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186023

            Bug ID: 1186023
           Summary: knot installed with transactional-update does not create knot group and user
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE MicroOS
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: idesmi-at-protonmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Installing knot with transactional update is unable to create the group knot
and user knot, also needed for create_dirs_from_rpmdb run by service
create-dirs-from-rpmdb.service on boot.

Additional rpm output:
groupadd: Cannot determine your user name.
useradd: group 'knot' does not exist
warning: user knot does not exist - using root
warning: group knot does not exist - using root
/usr/lib/tmpfiles.d/knot.conf:3: Failed to resolve user 'knot': No such process
touch: cannot touch '/var/lib/systemd/sysv-convert/database': No such file or
directory
/usr/lib/systemd/systemd-sysv-convert: line 25:
/var/lib/systemd/sysv-convert/database: No such file or directory
/usr/lib/systemd/systemd-sysv-convert: line 40:
/var/lib/systemd/sysv-convert/database: No such file or directory
Running in chroot, ignoring command 'daemon-reload'
Running in chroot, ignoring command 'try-restart'

This is solved by manually running:
$ groupadd -r knot
$ useradd -r -g knot -d /etc/knot -s /sbin/nologin -c "Knot DNS server" knot


--1620918818.CFC81.15184
Date: Thu, 13 May 2021 15:13:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186027

            Bug ID: 1186027
           Summary: VUL-1: CVE-2021-32917,CVE-2021-32918,CVE-2021-32919,CVE-2021- 32920,CVE-2021-32921: Prosody XMPP server advisory 2021-05-12 (multiple vulnerabilities)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/284222/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: mvetter-at-suse.com
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

Prosody security advisory 2021-05-12
====================================

Project
:   Prosody XMPP server

URL
:   https://prosody.im/

Date
:   2021-05-12

This advisory details 5 new security vulnerabilities discovered in the
Prosody.im XMPP server software. All issues are fixed in the 0.11.9 release
default configuration.

**References**

 - Release announcement: https://blog.prosody.im/prosody-0.11.9-released/
 - Advisory (HTML): https://prosody.im/security/advisory_20210512/
 - Advisory (text): https://prosody.im/security/advisory_20210512.txt

1/5: DoS via insufficient memory consumption controls
-----------------------------------------------------

CVE
: CVE-2021-32918

CVSS
: 7.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C)

CWEs
: CWE-400

Affected versions
: All versions prior to 0.11.9

Fixed versions
: 0.11.9, 0.11 nightly build 130, trunk nightly build 1434

**Description**

It was discovered that default settings leave Prosody susceptible to remote
unauthenticated denial-of-service (DoS) attacks via memory exhaustion when
running under Lua 5.2 or Lua 5.3. Lua 5.2 is the default and recommended Lua
version for Prosody 0.11.x series.

**Affected configurations**

The default configuration is susceptible to this issue.

Configurations with stricter settings for stanza size limits, rate limits and
garbage collection parameters are at decreased risk from this attack. For more
details please review the 'Mitigation' section for recommended values.

**Mitigation**

Mitigation is possible through configuration changes (on 0.11.7+). All the
configuration changes described in this section are applied by default in
Prosody 0.11.9.

1) Enable more aggressive garbage collection

   On Lua 5.2 and 5.3, the garbage collector does not free unused memory fast
   enough by default. This allowed Prosody's memory usage to grow excessively
   during certain traffic patterns.

   It is recommended to set a garbage collection speed of at least 500 in the
   global section of your configuration file:

   ```
     gc = {
       speed = 500;
     }
   ```

   Be aware that this setting may increase CPU usage if the other mitigations
   in this section are not applied.

2) Enable stricter stanza size limits

   By default Prosody ships with extremely permissive stanza size limits (up
   to 10MB). This value was introduced as a way to place a limit on memory
   usage without affecting legitimate use of the server. However testing
   demonstrates that the default limit is too high for most deployments.

   Our recommendation (and the default in 0.11.9) is to adopt the same default
   size limits that are already enforced by ejabberd, one of the other major
   XMPP servers on the network.

   To enable the new limits explicitly, add to the global section of your
   configuration file the following options:

     c2s_stanza_size_limit = 256 * 1024
     s2s_stanza_size_limit = 512 * 1024

   Be aware that reducing limits has the potential to introduce
   interoperability issues with deployments that do not enforce the same size
   limits. For example, remote contacts with large avatars.

3) Enable rate limits

   By default Prosody does not enable any rate limits. However we recommend
   enabling them for all production and public deployments to ensure fair
   consumption of resources across all connections.

   First, ensure that mod_limits is enabled by adding "limits" to your
   global modules_enabled configuration option:

   ```
     modules_enabled = {
       ...
       "limits";
       ...
     }
   ```

   Next, configure the limits:

   ```
     limits = {
       c2s = {
         rate = "10kb/s";
       };
       s2sin = {
         rate = "30kb/s";
       }
     }
   ```

**Advice**

All public deployments should upgrade to 0.11.9 or apply the above
configuration changes.

Deployments using nightly builds should upgrade to the latest available
builds.

**Credits**

Many thanks to Travis Burtrum (moparisthebest) for discovering and reporting
this issue, and providing a test case.

**Commits**

- https://hg.prosody.im/trunk/rev/db8e41eb6eff
- https://hg.prosody.im/trunk/rev/b0d8920ed5e5
- https://hg.prosody.im/trunk/rev/929de6ade6b6
- https://hg.prosody.im/trunk/rev/63fd4c8465fb
- https://hg.prosody.im/trunk/rev/1937b3c3efb5
- https://hg.prosody.im/trunk/rev/3413fea9e6db

----------------------------------------------------------------------------

2/5: DoS via repeated TLS renegotiation causing excessive CPU consumption
----------------------------------------------------------------------------

CVE
: CVE-2021-32920

CVSS
: 5.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C)

CWEs
: CWE-400

Affected versions
: All versions prior to 0.11.9

Fixed versions
: 0.11.9, 0.11 nightly build 130, trunk nightly build 1434

**Description**

It was discovered that Prosody does not disable SSL/TLS renegotiation, even
though this is not used in XMPP. A malicious client may flood a connection
with renegotiation requests to consume excessive CPU resources on the server.

Support for disabling renegotiation depends on OpenSSL 1.1.1+ and LuaSec 0.7+.

**Affected configurations**

The default configuration is susceptible to this issue.

**Temporary mitigation**

Ensure you have OpenSSL 1.1.1 or higher and LuaSec 0.7 or higher, and set the
following ssl option (or add to your existing one if you have one):

```
  ssl = {
    options = {
      no_renegotiation = true;
    }
  }
```

This configuration is applied by default in 0.11.9.

**Advice**

All public deployments should upgrade to 0.11.9 or apply the above
configuration changes.

Deployments using nightly builds should upgrade to the latest available
builds.

**Credits**

This flaw was discovered by Kim Alvefur, a member of the Prosody team.

**Commits**

- https://hg.prosody.im/trunk/rev/55ef50d6cf65
- https://hg.prosody.im/trunk/rev/5a484bd050a7
- https://hg.prosody.im/trunk/rev/aaf9c6b6d18d

-----------------------------------------------------------------------

3/5: Use of timing-dependent string comparison with sensitive values
-----------------------------------------------------------------------

CVE
: CVE-2021-32921

CVSS
: 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:U)

CWEs
: CWE-1254

Affected versions
: All versions prior to 0.11.9

Fixed versions
: 0.11.9, 0.11 nightly build 130, trunk nightly build 1434

**Description**

It was discovered that Prosody does not use a constant-time algorithm for
comparing certain secret strings when running under Lua 5.2 or later. This can
potentially be used in a timing attack to reveal the contents of secret
strings to an attacker.

Lua 5.1 utilizes a technique called "string interning", which protected string
comparisons from timing attacks. In Lua 5.2 and later versions, strings over
40 bytes in length are excluded from interning.

With Prosody running under Lua 5.2, this makes any secret string over 40 bytes
in length vulnerable to potential discovery via timing attacks.

Note that if a secret string contains non-ASCII (unicode) characters, it may
be longer than 40 bytes when encoded as UTF-8 (Prosody's internal encoding)
even if it is fewer than 40 characters long.

It should be noted that to successfully perform a timing attack, a significant
number of failed attempts must typically be made to "guess" at the contents of
the secret string.

We are not aware of any attempts to exploit this vulnerability (which would
likely be noticeable), and no known proof-of-concept exploit exists.

**Affected configurations**

This flaw affects the following modules:

  - mod_auth_internal_plain (disabled by default)

    mod_auth_internal_plain performs a timing-dependent comparison to the
    user's password if the user's password is longer than 40 bytes. This may
    allow an attacker to discover a user's password via a timing attack.

    We do not generally recommend mod_auth_internal_plain for new deployments,
    and mod_auth_internal_hashed has been the default for Prosody 0.11.x.

  - mod_muc (disabled by default)

    mod_muc supports password-protection of MUCs. The password validity check
    is performed using a timing-dependent comparison, which may allow an
    attacker to discover the MUC password via a timing attack if the password
    is longer than 40 bytes.

    We do not generally recommend using password-protected MUCs. Instead use
    affiliations to directly grant access to specific JIDs whenever possible.

  - mod_auth_internal_hashed (enabled by default but not typically vulnerable)

    mod_auth_internal_hashed has been updated for safety, but it is
    not vulnerable in the default configuration of Lua 5.2 as the password
    hashes it compares do not exceed 40 bytes.

  - mod_dialback (enabled by default but not typically vulnerable)

    mod_dialback has been updated for safety, but due to the single-use nature
    of s2s dialback verification strings a timing attack on this module is not
    believed to be possible, or to grant an attacker any advantage if it were.

**Temporary mitigation**

mod_auth_internal_plain: we recommend that people upgrade to
mod_auth_internal_hashed due to this and also to benefit from its other
security properties.

mod_muc: use affiliations to grant access to a MUC instead of passwords. If
passwords must be used, ensure they are shorter than 40 bytes.

Rate limits can greatly lengthen the amount of time required to successfully
complete a timing attack. Enable and configure mod_limits.

**Advice**

All deployments should upgrade to 0.11.9.

Deployments using nightly builds should upgrade to the latest available
builds.

**Credits**

This flaw was discovered by Matthew Wild, a member of the Prosody team. The
issue with MUC passwords was also previously identified by Robert Gr??sser.

**Commits**

- https://hg.prosody.im/trunk/rev/c98aebe601f9
- https://hg.prosody.im/trunk/rev/13b84682518e
- https://hg.prosody.im/trunk/rev/6f56170ea986

-------------------------------------------------------------------

4/5: Use of mod_proxy65 is unrestricted in default configuration
-------------------------------------------------------------------

CVE
: CVE-2021-32917

CVSS
: 5.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C)

CWEs
: CWE-862, CWE-400

Affected versions
: All versions prior to 0.11.9

Fixed versions
: 0.11.9, 0.11 nightly build 130, trunk nightly build 1434

**Description**

mod_proxy65 is a file transfer proxy provided with Prosody to facilitate the
transfer of files and other data between XMPP clients.

It was discovered that the proxy65 component of Prosody allows open access
by default, even if neither of the users have an XMPP account on the local
server, allowing unrestricted use of the server's bandwidth.

**Affected configurations**

The default configuration does not enable mod_proxy65 and is not affected.

With mod_proxy65 enabled, all configurations without a 'proxy65_acl' setting
configured are affected.

**Temporary mitigation**

Configure 'proxy65_acl' to a list of XMPP domains that should be allowed
to use the file transfer proxy.

**Advice**

All deployments should upgrade to 0.11.9 and/or configure a 'proxy65_acl' as
desired.

Deployments using nightly builds should upgrade to the latest available
builds.

The default behaviour in 0.11.9 allows all local clients to initiate a data
stream through the proxy if proxy65_acl is unconfigured.

**Credits**

This flaw was discovered by the Prosody team.

**Commits**

- https://hg.prosody.im/trunk/rev/65dcc175ef5b

--------------------------------------------------------------

5/5: Undocumented dialback-without-dialback option insecure
--------------------------------------------------------------

CVE
: CVE-2021-32919

Affected versions
: Prosody 0.10.x, Prosody 0.11.x prior to 0.11.9

Fixed versions
: 0.11.9, 0.11 nightly build 130, trunk nightly build 1434

**Description**

The undocumented option 'dialback_without_dialback' enabled an experimental
feature for server-to-server authentication. A flaw in this feature meant it
did not correctly authenticate remote servers, allowing a remote server to
impersonate another server when this option is enabled.

**Affected configurations**

The default configuration is not affected.

Configurations with the setting 'dialback_without_dialback' set to true are
affected.

**Temporary mitigation**

Remove or disable the 'dialback_without_dialback' option.

**Advice**

All deployments should upgrade to 0.11.9 or disable this feature.

Deployments using nightly builds should upgrade to the latest available
builds.

The affected feature has been removed in 0.11.9.

**Credits**

This flaw was discovered by the Prosody team.

**Commits**

- https://hg.prosody.im/trunk/rev/6be890ca492e
- https://hg.prosody.im/trunk/rev/d0e9ffccdef9


--1620941307.Aac70.21569
Date: Thu, 13 May 2021 21:28:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186040

            Bug ID: 1186040
           Summary: gdb crash internal-error: jit_event_handler
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: openSUSE Leap 15.2
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pafee-at-tycoint.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 849327
  --> http://bugzilla.opensuse.org/attachment.cgi?id=849327&action=edit
Stack trace with local variables included

While debugging a Qt4 application and setting a breakpoint on
QObject::startTimer.  The breakpoint successfully stops the program twice,
hitting the breakpoint for the third time (after continuing), gdb crashes
(reliably, was able to repeat a few times).

Tried both the latest Leap 15.2 RPM, gdb-10.1-lp152.7.6.1.x86_64 and also a
community version gdb-10.2-lp152.1.1.x86_64.rpm from here:
https://build.opensuse.org/package/binaries/home:AndreasSchwab/gdb/15.2

Both gdb 10.1 and 10.2 crashed in the same way with the same stack trace.

Asking gdb to capture a core fill, the examining gdb's corefile with gdb the
stack trace was obtained (attached).

Output on the terminal where gdb was running:

==============================
../../gdb/jit.c:1278: internal-error: void jit_event_handler(gdbarch*,
objfile*): Assertion `jiter->jiter_data != nullptr' failed.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
Quit this debugging session? (y or n) y

This is a bug, please report it.  For instructions, see:
<http://bugs.opensuse.org/>.

../../gdb/jit.c:1278: internal-error: void jit_event_handler(gdbarch*,
objfile*): Assertion `jiter->jiter_data != nullptr' failed.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
Create a core file of GDB? (y or n) y
Aborted (core dumped)
==============================

Is this stack trace helpful or has too much information been "optimized out"?
Code from frame 6:
???   1271        void
???   1272        jit_event_handler (gdbarch *gdbarch, objfile *jiter)
???   1273        {
???   1274          struct jit_descriptor descriptor;
???   1275
???   1276          /* If we get a JIT breakpoint event for this objfile, it is
necessarily a
???   1277             JITer.  */
???  >1278          gdb_assert (jiter->jiter_data != nullptr);

Code from frame 7:
???   5493          bound_minimal_symbol jit_bp_sym = lookup_minimal_symbol_by_pc
(address);
???   5494          gdb_assert (jit_bp_sym.objfile != nullptr);
???  >5495          jit_event_handler (gdbarch, jit_bp_sym.objfile);

The data that triggers the crash is returned from lookup_minimal_symbol_by_pc()
on line 5493.

???   931         struct bound_minimal_symbol
???   932         lookup_minimal_symbol_by_pc (CORE_ADDR pc)
???   933         {
???   934           return lookup_minimal_symbol_by_pc_section (pc, NULL);
???   935         }

lookup_minimal_symbol_by_pc_section() can be found in gdb/minsyms.c.

That file does not appear to be patched in the Leap source RPM.  Therefore this
may be a bug in the upstream gdb source.


--1621031805.D47b685d14.8929
Date: Fri, 14 May 2021 22:36:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186080

            Bug ID: 1186080
           Summary: 'borg mount' fails due to missing python3-llfuse package
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pujos.michael-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

'borg mount' fails with error:

borg mount not available: loading FUSE support failed [ImportError: No module
named 'llfuse']

This is caused by the python3-llfuse package (recommended by package
borgbackup) not being available at all on TW:

$zypper se python3-llfuse
Loading repository data...
Reading installed packages...
No matching items found.

How come package python3-llfuse has disappeared ?


body:
--1621088379.8DfFd6D1.3404
Date: Sat, 15 May 2021 14:19:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186088

            Bug ID: 1186088
           Summary: Java:packages/snakeyaml: CVE-2017-18640
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: fstrba-at-suse.com
          Reporter: rpm-at-fthiessen.de
        QA Contact: screening-team-bugs-at-suse.de
                CC: pmonrealgonzalez-at-suse.com
          Found By: ---
           Blocker: ---

There is a vulnerability in snakeyaml version 1.25 currently in Factory

CVE-2017-18640: "Improper Restriction of Recursive Entity References in DTDs"
[1]

This is fixed in 1.26[2][3], but you might consider updating to the latest
release: 1.28[4]

[1] https://nvd.nist.gov/vuln/detail/CVE-2017-18640
[2]
https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion
[3] https://bitbucket.org/asomov/snakeyaml/wiki/Changes
[4] https://bitbucket.org/asomov/snakeyaml/downloads/?tab=tags

summary: Java:packages/snakeyaml: CVE-2017-18640


--1621103087.B8a2aB0.21329
Date: Sat, 15 May 2021 18:24:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186091

            Bug ID: 1186091
           Summary: openvpn stopped to work between and 2021-04-17 2021-05-12
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i686
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: miguel-at-rozsas.eng.br
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

NM was able to bring up a openVPN connection in 2021-04-17 but not in
2021-05-12. No modifications were made in related config file between
2021-04-17 and 2021-05-12.

Rolling the system back to 2021-04-17 re-enable NM/OVPN back.

Firing up the same openvpn connection without NM works too on  2021-05-12.

Check this:
NM Working on 2021-04-17: https://pastebin.com/tPWJA8Ct
NM Not working on 2021-05-12: https://pastebin.com/xSuE1yYm
journalctl output: https://pastebin.com/qnT7bc0G

openvpn config file: (note the date of config file, so it was working for about
3 years)
miguel $ ls -l Misc/openVPN/apice/1195/
total 8
-rw-r--r


--1621103968.eEca7D5.14009
Date: Sat, 15 May 2021 18:39:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186092

            Bug ID: 1186092
           Summary: Invisible windows on clean Leap 15.3 beta install with gnome and wayland
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: 64bit
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: alex.a-at-web.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 849362
  --> http://bugzilla.opensuse.org/attachment.cgi?id=849362&action=edit
Invisible opensuse welcome window

Hi,

I'm now testing Leap 15.3 beta on a clean install and many windows from new
opened programs stay invisible or just have a shadow like in the attached
picture. The programs itself are running as I can see them with ps and in the
dash. Some windows are visible: e.g. Firefox, Thunderbird, Nautilus, Terminal.

I've traced it down that removing gnome-session-wayland solves the issue.
However without it other things don't work, e.g. my 2nd Monitor stays black,
terminal takes long time to open.

Before that I've upgraded from Leap 15.2 to 15.3 and gnome was crashing when
opening same windows which stay invisible now (Firefox etc. worked fine).

In journalctl I see a lot of "... gnome-shell[xxxx]: Modifiers specified, but
DRI is too old" entries. Seems to be related to Mesa driver (?). The versions
of Mesa and Mesa-dri do not match.
Nothing interesting in dmesg.

Have never seen such issue on Leap 15.2 and Tumbleweed before.

Tried without success:
 use only one monitor, disable gnome extensions, install vendor GPU driver.

Have seen some related issues with KDE plasma:
https://forums.opensuse.org/showthread.php/539874-Wayland-Plasma-Application-windows-not-showing-up-cause-session-crash
Can't use the workaround suggested there as there are no such options with
gnome.

package versions:
 gnome-session-wayland 3.34.2-6.3.1
 Mesa     20.2.4-57.13
 Mesa-dri 20.2.4-57.12

My specs:
 CPU: AMD Ryzen 5 3600, GPU: AMD Radeon RX 5700
 OpenSUSE 15.3 beta  Kernel: 5.3.18-57-default x86_6
 from inxi -GxxSza:
    Graphics:  Device-1: Advanced Micro Devices [AMD/ATI] Navi 10 [Radeon RX
5600 OEM/5600 XT / 5700/5700 XT] vendor: Tul
               driver: amdgpu v: kernel bus ID: 28:00.0 chip ID: 1002:731f
               Display: wayland server: X.Org 1.20.3 compositor: gnome-shell
driver: amdgpu,ati
               unloaded: fbdev,modesetting,radeon,vesa display ID: :0 screens:
1
               OpenGL: renderer: AMD Radeon RX 5700 (NAVI10 DRM 3.39.0
5.3.18-57-default LLVM 11.0.1) v: 4.6 Mesa 20.2.4
               direct render: Yes


body:
--1621162105.E237B0840.24395
Date: Sun, 16 May 2021 10:48:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186096

            Bug ID: 1186096
           Summary: BeagleBone Black lost USB support
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: matwey.kornilov-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

I am running
openSUSE-Leap-15.3-ARM-JeOS-beaglebone.armv7l-2021.04.16-Build2.2.raw.xz from
openSUSE:Leap:15.3:ARM:Images

# uname -a
Linux localhost 5.3.18-57-default #1 SMP Wed Apr 28 10:54:41 UTC 2021 (ba3c2e9)
armv7l armv7l armv7l GNU/Linux

Currently, I see that USB is not working.

# lsusb

returns empty output.
musb related kernel modules are also not loaded and missed from
/lib/modules/5.3.18-57-default

BBB has USB support (yet not ideal) on Leap 15.2, so this must be a kind of
regression somewhere in configuration.

summary: BeagleBone Black lost USB support


--1621253770.DFdaD1.9456
Date: Mon, 17 May 2021 12:16:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186125

            Bug ID: 1186125
           Summary: MicroOS snapshot 20210515 CoreDNS fails to resolve external addresses
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: marc-at-msys.ch
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Kubernetes cluster updated to MicroOS snapshort 20210515.  CoreDNS stops
working, can not resolve external addresses.  Can not access Rancher anymore
that runs on a separate machine.

Rollback to the last snapshot "resolves" the issue.


--1621329082.B172083A0.5641
Date: Tue, 18 May 2021 09:11:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186178

            Bug ID: 1186178
           Summary: issue-generator runs agetty in wrong SELinux context
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: MicroOS
          Assignee: kukuk-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: jsegitz-at-suse.com
          Found By: ---
           Blocker: ---

Wondering about

type=AVC msg=audit(1621328149.984:60): avc:  denied  { watch } for  pid=1174
comm="agetty" path="/run/agetty.reload" dev="tmpfs" ino=1011
scontext=system_u:system_r:getty_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0

# fixfiles check /run/agetty.reload
skipping the directory /var/lib/overlay
Would relabel /run/agetty.reload from system_u:object_r:var_run_t:s0 to
system_u:object_r:getty_var_run_t:s0

=> /run/agetty.reload was created with wrong label. Using audit rules

-a always,exit -F path=/usr/sbin/agetty -F perm=x
-a always,exit -F arch=b64 -S openat -F path=/run/agetty.reload

Reveals that something calls agetty --reload early. Turns out it's issue
generator. Looks like agetty runs in wrong context

----
time->Tue May 18 08:55:44 2021
type=PROCTITLE msg=audit(1621328144.100:10):
proctitle=2F7573722F7362696E2F616765747479002D2D72656C6F6164
type=PATH msg=audit(1621328144.100:10): item=1
name="/lib64/ld-linux-x86-64.so.2" inode=316653 dev=00:22 mode=0100755 ouid=0
ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0
cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1621328144.100:10): item=0 name="/usr/sbin/agetty"
inode=291934 dev=00:22 mode=0100755 ouid=0 ogid=0 rdev=00:00
obj=system_u:object_r:getty_exec_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0
cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1621328144.100:10): cwd="/"
type=EXECVE msg=audit(1621328144.100:10): argc=2 a0="/usr/sbin/agetty"
a1="--reload"
type=BPRM_FCAPS msg=audit(1621328144.100:10): fver=0 fp=0 fi=0 fe=0
old_pp=000001f7fdffffff old_pi=0 old_pe=000001f7fdffffff old_pa=0
pp=000001f7fdffffff pi=0 pe=000001f7fdffffff pa=0 frootid=0
type=SYSCALL msg=audit(1621328144.100:10): arch=c000003e syscall=59 success=yes
exit=0 a0=55c15e97ff40 a1=55c15e97da60 a2=55c15e973260 a3=55c15d752d92 items=2
ppid=511 pid=532 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="agetty" exe="/usr/sbin/agetty"
subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
----


--1621337358.AEcB1.698
Date: Tue, 18 May 2021 11:29:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1186194

            Bug ID: 1186194
           Summary: Many processes and up in D state after system resume (5.12.3-1-default, git 25d4ec7)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: lpechacek-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: oneukum-at-suse.com
          Found By: ---
           Blocker: ---

Created attachment 849440
  --> https://bugzilla.suse.com/attachment.cgi?id=849440&action=edit
Output of SysRq-T

I'm using a Dell laptop (Inspiron 7373) with a USB ethernet adapter (17ef:7205
Lenovo Thinkpad LAN, driver r8152). Sometimes, after resume, network-related
utilities (e.g. ip, ping) freeze in D state. No communication over IP networks
is possible. Attached is SysRq-T from the malfunctioning state.

From my POV, the following stand out:

May 18 11:00:34 fmn kernel: task:teams           state:D stack:    0 pid:  316
ppid:  3234 flags:0x00000000
May 18 11:00:34 fmn kernel: Call Trace:
May 18 11:00:34 fmn kernel:  __schedule+0x2ee/0x950
May 18 11:00:34 fmn kernel:  schedule+0x46/0xb0
May 18 11:00:34 fmn kernel:  rpm_resume+0x19c/0x7b0
May 18 11:00:34 fmn kernel:  ? wait_woken+0x80/0x80
May 18 11:00:34 fmn kernel:  rpm_resume+0x2e7/0x7b0
May 18 11:00:34 fmn kernel:  ? kernfs_fop_open+0x2a8/0x3a0
May 18 11:00:34 fmn kernel:  __pm_runtime_resume+0x4a/0x80
May 18 11:00:34 fmn kernel:  usb_autopm_get_interface+0x18/0x50 [usbcore]
May 18 11:00:34 fmn kernel:  rtl8152_get_link_ksettings+0x27/0x80 [r8152]
May 18 11:00:34 fmn kernel:  speed_show+0x6e/0xb0
May 18 11:00:34 fmn kernel:  dev_attr_show+0x19/0x40
May 18 11:00:34 fmn kernel:  sysfs_kf_seq_show+0xa6/0xe0
May 18 11:00:34 fmn kernel:  seq_read_iter+0x1e1/0x510
May 18 11:00:34 fmn kernel:  new_sync_read+0x115/0x1a0
May 18 11:00:34 fmn kernel:  vfs_read+0x14b/0x1a0
May 18 11:00:34 fmn kernel:  ksys_read+0x5f/0xe0
May 18 11:00:34 fmn kernel:  do_syscall_64+0x33/0x80
May 18 11:00:34 fmn kernel:  entry_SYSCALL_64_after_hwframe+0x44/0xae

AND

May 18 11:00:34 fmn kernel: task:kworker/3:2     state:D stack:    0 pid:23489
ppid:     2 flags:0x00004000
May 18 11:00:34 fmn kernel: Workqueue: pm pm_runtime_work
May 18 11:00:34 fmn kernel: Call Trace:
May 18 11:00:34 fmn kernel:  __schedule+0x2ee/0x950
May 18 11:00:34 fmn kernel:  schedule+0x46/0xb0
May 18 11:00:34 fmn kernel:  schedule_timeout+0x8b/0x140
May 18 11:00:34 fmn kernel:  ? __next_timer_interrupt+0x100/0x100
May 18 11:00:34 fmn kernel:  msleep+0x2a/0x40
May 18 11:00:34 fmn kernel:  napi_disable+0x2b/0x70
May 18 11:00:34 fmn kernel:  rtl8152_suspend+0x2ad/0x340 [r8152]
May 18 11:00:34 fmn kernel:  usb_suspend_both+0x9d/0x230 [usbcore]
May 18 11:00:34 fmn kernel:  usb_runtime_suspend+0x2b/0x70 [usbcore]
May 18 11:00:34 fmn kernel:  ? usb_autoresume_device+0x50/0x50 [usbcore]
May 18 11:00:34 fmn kernel:  __rpm_callback+0x81/0x140
May 18 11:00:34 fmn kernel:  rpm_callback+0x4f/0x70
May 18 11:00:34 fmn kernel:  ? usb_autoresume_device+0x50/0x50 [usbcore]
May 18 11:00:34 fmn kernel:  rpm_suspend+0x147/0x6f0
May 18 11:00:34 fmn kernel:  ? __switch_to+0x26f/0x450
May 18 11:00:34 fmn kernel:  pm_runtime_work+0x8e/0x90
May 18 11:00:34 fmn kernel:  process_one_work+0x1df/0x370
May 18 11:00:34 fmn kernel:  worker_thread+0x50/0x400
May 18 11:00:34 fmn kernel:  ? process_one_work+0x370/0x370
May 18 11:00:34 fmn kernel:  kthread+0x11b/0x140
May 18 11:00:34 fmn kernel:  ? __kthread_bind_mask+0x60/0x60
May 18 11:00:34 fmn kernel:  ret_from_fork+0x22/0x30


body:
--1621353192.6Baf1.8726
Date: Tue, 18 May 2021 15:53:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1186213

            Bug ID: 1186213
           Summary: Replace mkinitrd with dracut
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: MicroOS
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

transactional-update is calling mkinitrd, but that's deprecated and will be
removed in the near future (see factory@ mailing list).

We should replace mkinitd with dracut.

summary: Replace mkinitrd with dracut


body:
--1621410444.433Ce2e11.32742
Date: Wed, 19 May 2021 07:47:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186233

            Bug ID: 1186233
           Summary: lua README contains wrong information
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: giecrilj@stegny.2a.pl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The file '/usr/share/doc/packages/lua54/README' contains incorrect information:

> see doc/readme.html.

summary: lua README contains wrong information


--1621419612.faec0eE9.20373
Date: Wed, 19 May 2021 10:20:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186238

            Bug ID: 1186238
           Summary: VUL-0: CVE-2020-24119: upx: heap buffer overflow in p_lx_elf.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/284327/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: jengelh-at-inai.de
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-24119

A heap buffer overflow read was discovered in upx 4.0.0, because the check in
p_lx_elf.cpp is not perfect.

https://github.com/upx/upx/issues/388

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1961591
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24119
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24119
https://github.com/upx/upx/issues/388


--1621431075.DFbDB0.12566
Date: Wed, 19 May 2021 13:31:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186251

            Bug ID: 1186251
           Summary: VUL-0: CVE-2021-20204: getdata: Use after free in _GD_Supports() in encoding.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/283360/
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Development
          Assignee: ctrippe-at-opensuse.org
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-20204

A heap memory corruption problem (use after free) can be triggered in
libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This
degrades the confidentiality, integrity and availability of third-party
software that uses libgetdata as a library. This vulnerability may lead to
arbitrary code execution or privilege escalation depending on input/skills of
attacker.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1917635

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1956348
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20204


--1621437380.4AdDDD0.20941
Date: Wed, 19 May 2021 15:16:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1186256

            Bug ID: 1186256
           Summary: qemu-linux-user: hardcoded binfmt handler doesn't play well with containers
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 849481
  --> https://bugzilla.suse.com/attachment.cgi?id=849481&action=edit
Proposed patch for qemu-binfmt-conf.sh

Since abbc0ce ("qemu-binfmt-conf: use qemu-ARCH-binfmt"),
qemu-binfmt-conf.sh under openSUSE automatically replaces the default qemu
binfmt wrapper "qemu-$ARCH" with "qemu-$ARCH-binfmt" in order to ensure that
argv[0] is preserved; qemu-$ARCH-binfmt is a link to qemu-binfmt, which is just
a simple wrapper that mangles argv to achieve the desired result.
This is a SUSE-specific modification which isn't used upstream.

This approach is inconvenient in some situations. In particular for running
foreign-arch containers, it's useful to use the binfmt_misc "F" ("fix
binary") flag to pre-load the qemu wrapper in the kernel. That way,
foreign-arch containers can be run just like native containers, without
having to bind-mount interpreters into the container. But that's impossible
with the SUSE binfmt wrapper that needs to exec() a different (native)
executable.

In the openSUSE default mode of qemu-binfmt-conf.sh, the user needs to
bind-mount both the -binfmt executable and the actual emulator into the
container:

> $ podman run -it --rm \
>       -v /usr/bin/qemu-ppc64le-binfmt:/usr/bin/qemu-ppc64le-binfmt \
>       -v /usr/bin/qemu-ppc64le:/usr/bin/qemu-ppc64le \
>       ppc64le/busybox uname -m
> ppc64le

Otherwise, he gets

> $ podman run -t --rm ppc64le/busybox uname -m
> standard_init_linux.go:219: exec user process caused: no such file or directory

If qemu-binfmt-conf.sh is used with the --persistent flag, qemu-ppc64le-binfmt
is loaded into the kernel, but qemu-ppc64le must still be bind-mounted.
If qemu-ppc64le was used directly as persistent binfmt_misc helper, it would be
sufficient to run the container as if it was a native one:

> $ podman run -it --rm  ppc64le/busybox uname -m
> ppc64le

I can see why it makes sense to try to preserve argv[0], but for me at least,
the "foreign container" use case is more important. Therefore I'd like to be
able to switch the behavior of the qemu binfmt_misc helper back to the upstream
default.

So far I've worked around the issue by simply using the upstream container
"docker.io/multiarch/qemu-user-static", but I'd like to be able to do this
easily with openSUSE on-board tools.

The attached patch allows the user to override the default "-binfmt" suffix by
running "qemu-binfmt-conf.sh --qemu-suffix ''".

(Note: "qemu-binfmt-conf.sh -F ''" doesn't work, that's a different issue).


--1621438173.acb8C30.21903
Date: Wed, 19 May 2021 15:29:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186258

            Bug ID: 1186258
           Summary: [Build 20210518] psmisc: calling out to setcap not allowed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/1749271/modules/lsof
                    /steps/3
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

openQA test in scenario
opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-filesystem@64bit_virtio
fails in
[lsof](https://openqa.opensuse.org/tests/1749271/modules/lsof/steps/3)

## Test suite description
Filesystems JeOS test suite. Maintainer: qa-c-at-suse.de

Explicitly calling out to setcap in a spec file is not permitted. For this, we
have the permissions package that assigns capabilities to binaries, based on
the wanted trust level of an admin.

As the change is not working reliably anyway (setcap is not available in all
cases) the change is being reverted in :Factory

## Reproducible

Fails since (at least) Build
[20210518](https://openqa.opensuse.org/tests/1749271) (current job)

## Expected result

Last good: [20210517](https://openqa.opensuse.org/tests/1747260) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=JeOS-for-kvm-and-xen&machine=64bit_virtio&test=jeos-filesystem&version=Tumbleweed)


--1621455019.E47dCd0.10060
Date: Wed, 19 May 2021 20:10:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186267

            Bug ID: 1186267
           Summary: ERROR: failed to open configuration file /etc/php8/fpm/php-fpm.conf : Permission denied (13)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: eric-at-madrid.lol
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I have been having this problem since PHP 8.x was added to the repository, php
7.x works fine.
I finally had to resort to using Apache, which does not require php-fpm, for
all my openSuSE TW servers...
I have no problem using NGiNX and php-fpm 8.x with openSuSE Leap.
But, openSuSE TW will not run php-fpm 8.x...
[18-May-2021 13:58:55] ERROR: failed to open configuration file
'/etc/php8/fpm/php-fpm.conf': Permission denied (13)

Thanks, for all your hard work!


--1621465037.0D2C345.18744
Date: Wed, 19 May 2021 22:57:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186270

            Bug ID: 1186270
           Summary: AUDIT-0: libvirt: new polkit permissions for node device delete
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jfehlig-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

libvirt 7.3.0 gets a new polkit permission for the node device object via
commit bb311cede79, which causes the following lint failure

libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10)
org.libvirt.api.node-device.delete (no:no:no)

Hopefully non-controversial to whitelist with the 'no:no:no' perms. Error can
be seen here

https://build.opensuse.org/build/Virtualization/openSUSE_Factory/x86_64/libvirt/_log

First noticed by dimstar in this request

https://build.opensuse.org/request/show/894106


--1621499202.73e8aB60.10863
Date: Thu, 20 May 2021 08:26:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186282

            Bug ID: 1186282
           Summary: %sysusers_create_inline needs awkward syntax
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: fbui-at-suse.com
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
                CC: ngompa13-at-gmail.com
          Found By: ---
           Blocker: ---

Definition:

    %sysusers_create_inline() \
    if [ -x /usr/bin/systemd-sysusers ]; then \
            echo %{?*} | systemd-sysusers - || : \
    fi

When using this with

    %sysusers_create_inline u solanum - "Solanum ircd"

I am getting a syntax error (from systemd-sysusers), because the injection of
arguments towards echo which flattens them.

The hack workaround is

    %sysusers_create_inline 'u solanum - "Solanum ircd"'

Does anyone see room for improving the argument passing?


--1621540111.dDbF2A0011.890
Date: Thu, 20 May 2021 19:48:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186320

            Bug ID: 1186320
           Summary: Current driver (module pl2303.ko) for Prolific chip 23a3  does not work on Leap 15.2 kernel
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: jfharrison-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Prolific USB to Full UART Bridge Controller with GPIO
Chip PL2303GC
Part No. PL2303G4ZJG8P2
Chip Product ID 23a3

From dmesg using kernel Linux 5.3.18-lp152.75-default

[ 1434.839253] usb 5-2: new full-speed USB device number 3 using uhci_hcd
[ 1435.038231] usb 5-2: New USB device found, idVendor=067b, idProduct=23a3,
bcdDevice= 1.05
[ 1435.038238] usb 5-2: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[ 1435.038243] usb 5-2: Product: USB-Serial Controller
[ 1435.038247] usb 5-2: Manufacturer: Prolific Technology Inc.
[ 1435.038251] usb 5-2: SerialNumber: BUAMj19B616

output from lusb:

T:  Bus=05 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#=  3 Spd=12  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=067b ProdID=23a3 Rev=01.05
S:  Manufacturer=Prolific Technology Inc.
S:  Product=USB-Serial Controller
S:  SerialNumber=BUAMj19B616
C:  #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)

I updated kernel to stable 15.12.4-5.gcf6ea2f and the pl2303 module in that
kernel works perfectly.  It is using module pl2303.ko.xz

Hopefully that module can be included in the Leap15.3 release.


--1621584949.EBc7c0.6255
Date: Fri, 21 May 2021 08:15:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186327

            Bug ID: 1186327
           Summary: spyder-5.0.2-1.1 does not start, missing watchdog<2.0.0,>=0.10.3, found watchdog 2.1.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: michael-at-actrix.gen.nz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The spyder python IDE fails to start because it requires a version of
python38-watchdog <2.0.0,>=0.10.3 and tumbleweed python38-watchdog is version
2.1.  TW 20210519 jumped python-38-watchdog from 1.0.2 to 2.1.1.  Traceback is
below:

% spyder
Traceback (most recent call last):
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 583,
in _build_master
    ws.require(__requires__)
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 900,
in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 791,
in resolve
    raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (watchdog 2.1.1
(/usr/lib/python3.8/site-packages),
Requirement.parse('watchdog<2.0.0,>=0.10.3'), {'spyder'})

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/spyder", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 3252,
in <module>
    def _initialize_master_working_set():
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 3235,
in _call_aside
    f(*args, **kwargs)
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 3264,
in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 585,
in _build_master
    return cls._build_from_requirements(__requires__)
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 598,
in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 786,
in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'watchdog<2.0.0,>=0.10.3' distribution
was not found and is required by spyder


--1621602925.0C3Dd7C80.2974
Date: Fri, 21 May 2021 13:15:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1186341

            Bug ID: 1186341
           Summary: emacs-gtk crashes when hitting Ctrl-<space>
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When hitting ctrl-space (set-mark-command), emacs reproducibly crashes.

#0  XVisualIDFromVisual (visual=0x0) at Misc.c:60
#1  0x00007f8ef5a4e2de in gdk_x11_window_foreign_new_for_display
(display=0x22220e0 [GdkX11Display], window=90177538) at
x11/gdkwindow-x11.c:1270
#2  0x00007f8ef5a39478 in gdk_x11_display_translate_event
    (translator=<optimized out>, display=0x22220e0 [GdkX11Display],
event=0x2238be0, xevent=0xa7e3b0 <old_fcntl_owner+1168>) at
x11/gdkdisplay-x11.c:1116
#3  0x00007f8ef5a3acc1 in _gdk_x11_event_translator_translate
    (translator=0x22220e0, display=0x22220e0 [GdkX11Display],
xevent=xevent@entry=0xa7e3b0 <old_fcntl_owner+1168>) at
x11/gdkeventtranslator.c:51
#4  0x00007f8ef5a3e800 in gdk_event_source_translate_event (xevent=0xa7e3b0
<old_fcntl_owner+1168>, event_source=0x2239a30) at x11/gdkeventsource.c:243
#5  _gdk_x11_display_queue_events (display=0x22220e0 [GdkX11Display]) at
x11/gdkeventsource.c:341
#6  0x00007f8ef5a056a9 in gdk_display_get_event (display=0x22220e0
[GdkX11Display]) at gdkdisplay.c:442
#7  0x00007f8ef5a3ea22 in gdk_event_source_dispatch
(source=source@entry=0x2239a30, callback=<optimized out>, user_data=<optimized
out>) at x11/gdkeventsource.c:363
#8  0x00007f8ef54288b7 in g_main_dispatch (context=0x2239b20) at
../glib/gmain.c:3337
#9  g_main_context_dispatch (context=0x2239b20) at ../glib/gmain.c:4055
#10 0x00007f8ef5428c38 in g_main_context_iterate
(context=context@entry=0x2239b20, block=block@entry=1,
dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/gmain.c:4131
#11 0x00007f8ef5428cef in g_main_context_iteration (context=0x2239b20,
context@entry=0x0, may_block=may_block@entry=1) at ../glib/gmain.c:4196
#12 0x00007f8ef5d19385 in gtk_main_iteration () at gtkmain.c:1433
#13 0x00000000004ed0c3 in XTread_socket (terminal=<optimized out>,
hold_quit=0xa7e620 <old_fcntl_owner+1792>) at xterm.c:9396
#14 0x0000000000514312 in gobble_input () at keyboard.c:6892
#15 0x00000000005865a5 in handle_async_input () at keyboard.c:7129
#16 process_pending_signals () at keyboard.c:7143


body:
--1621605711.ECDB10.9153
Date: Fri, 21 May 2021 14:01:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186344

            Bug ID: 1186344
           Summary: AUDIT-0: setroubleshoot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

setroubleshoot installs a dbus service with polkit privilege. Please whitelist
for inclusion in Factory

https://build.opensuse.org/package/show/security:SELinux/setroubleshoot

[   57s] setroubleshoot-server.x86_64: W: polkit-untracked-privilege
org.fedoraproject.setroubleshootfixit.write (auth_admin:auth_admin:auth_admin)

[   57s]
[   57s] setroubleshoot-server.x86_64: W: suse-dbus-unauthorized-service
/usr/share/dbus-1/system-services/org.fedoraproject.SetroubleshootFixit.service
[   57s] setroubleshoot-server.x86_64: W: suse-dbus-unauthorized-service
/usr/share/dbus-1/system-services/org.fedoraproject.SetroubleshootPrivileged.service
[   57s] setroubleshoot-server.x86_64: W: suse-dbus-unauthorized-service
/usr/share/dbus-1/system-services/org.fedoraproject.Setroubleshootd.service
[   57s] setroubleshoot-server.x86_64: W: suse-dbus-unauthorized-service
/usr/share/dbus-1/system.d/org.fedoraproject.SetroubleshootFixit.conf
[   57s] setroubleshoot-server.x86_64: W: suse-dbus-unauthorized-service
/usr/share/dbus-1/system.d/org.fedoraproject.SetroubleshootPrivileged.conf
[   57s] setroubleshoot-server.x86_64: W: suse-dbus-unauthorized-service
/usr/share/dbus-1/system.d/org.fedoraproject.Setroubleshootd.conf
[   57s] The package installs a DBUS system service file.             If the
package is

pkgs: polkit-default-privs rpmlint

summary: AUDIT-0: setroubleshoot


--1621658925.EbEE33fa0.8520
Date: Sat, 22 May 2021 04:48:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186359

            Bug ID: 1186359
           Summary: chkconfig missing in systemd-sysv-install
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: t.rother-at-netzwissen.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When installing vmware workstation, I get

odysseus3:~ # systemctl enable vmware.service
vmware.service is not a native service, redirecting to systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable vmware
/usr/lib/systemd/systemd-sysv-install: line 33: chkconfig: command not found

chkconfig ist a part of aaa_base, but even a re-install of aaa_base does not
provide chkconfig.


--1621672004.1BA4ae3D0.20145
Date: Sat, 22 May 2021 08:26:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186361

            Bug ID: 1186361
           Summary: Clean shutdown of VirtualBoxes during power off doesn't work.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: openSUSE Leap 15.2
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: andrew-at-fluidgravity.co.uk
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I would like to use this feature that is supposed to be available in
VirtualBox:

# enter the following variables in /etc/default/virtualbox:
#   SHUTDOWN_USERS="foo bar"
#     check for running VMs of user foo and user bar
#   SHUTDOWN=poweroff
#   SHUTDOWN=acpibutton
#   SHUTDOWN=savestate
#     select one of these shutdown methods for running VMs

But, it doesn't work in Leap 15.2.

I browsed the source code and it's implemented in the file
/usr/lib/virtualbox/vboxdrv.sh:
https://www.virtualbox.org/browser/vbox/trunk/src/VBox/Installer/linux/vboxdrv.sh

The VirtualBox package supplied by the OpenSUSE repo has its own version of
vboxdrv.sh which is missing the code required to shudown any VMs.

Could I request that the feature be added to the OpenSUSE package?


--1621682442.Ce612F50.13817
Date: Sat, 22 May 2021 11:20:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1186362

            Bug ID: 1186362
           Summary: ca-certificates-cacert root certificate expired
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

we need to update the certificate as the current one expired last week.


--1621979230.01230.10123
Date: Tue, 25 May 2021 21:47:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1186455

            Bug ID: 1186455
           Summary: Backport fix for SEGFAULT of RawTherapee
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: postix-at-posteo.eu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

RawTherapee 5.8-3.7 suffers an annoying SEGFAULT, which has been fixed by [1]
short after the release of RT 5.8 last year. Debian also has backported this
fix. [2]

It'd be appreciated a lot if you could backport this fix, too.

[1]
https://github.com/Beep6581/RawTherapee/commit/e7a4ae3c9fa987d625b537573fd811a9cb5d2fb8

[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961376