--17362688284.ad6eb1b4f.1550
Date: Tue, 7 Jan 2025 16:53:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235367

            Bug ID: 1235367
           Summary: VUL-0: CVE-2024-45338: gitea-tea: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/433408/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-45338:5.9:(AV:N/AC:H/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
                    CVSSv4:SUSE:CVE-2024-45338:8.2:(AV:N/AC:H/AT:P/PR:N/UI
                    :N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1234794
  Target Milestone: ---
          Found By: ---
           Blocker: ---

An attacker can craft an input to the Parse functions that would be process=
ed
non-linearly with respect to its length, resulting in extremely slow parsin=
g.
This could cause a denial of service.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45338
https://www.cve.org/CVERecord?id=3DCVE-2024-45338
https://go.dev/cl/637536
https://go.dev/issue/70906
https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
https://pkg.go.dev/vuln/GO-2024-3333
https://bugzilla.redhat.com/show_bug.cgi?id=3D2333122
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17362688284.ad6eb1b4f.1550
Date: Tue, 7 Jan 2025 16:53:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235367

          Summary
          VUL-0: CVE-2024-45338: gitea-tea: golang.org/x/net/html: deni=
al of service due to non-linear parsing of case-insensitive content

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/433408/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-45338:5.9:(AV:N/AC:H/PR:N/UI:N/S:U/C:N=
/I:N/A:H) CVSSv4:SUSE:CVE-2024-45338:8.2:(AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:=
N/VA:H/SC:N/SI:N/SA:N)

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1234794

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

An attacker can craft an input to the Parse functions that w=
ould be processed
non-linearly with respect to its length, resulting in extremely slow parsin=
g.
This could cause a denial of service.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-45338
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-45338
https://go.dev/cl/637536
https://go.dev/issue/70906
https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0=
mRMAwAJ
https://pkg.go.dev/vuln/GO=
-2024-3333
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2333122

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17362688284.ad6eb1b4f.1550--


body:
--17363318661.43d0.593
Date: Wed, 8 Jan 2025 10:24:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235422

            Bug ID: 1235422
           Summary: chromium  131.0.6778.264 CVE-2025-0291
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ro-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

* CVE-2025-0291: Type Confusion in V8=20
  * Various fixes from internal audits, fuzzing and other initiatives

https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-des=
ktop.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17363318661.43d0.593
Date: Wed, 8 Jan 2025 10:24:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235422

          Summary
          chromium  131.0.6778.264 CVE-2025-0291

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          ro@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

* CVE-2025-0291: Type Confusion in V8=20
  * Various fixes from internal audits, fuzzing and other initiatives

https://chromereleases.googleblog.com/2025/01/stable-=
channel-update-for-desktop.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17363318661.43d0.593--

summary: chromium  131.0.6778.264 CVE-2025-0291


--17363401331.D327.107
Date: Wed, 8 Jan 2025 12:42:13 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235443

            Bug ID: 1235443
           Summary: conman: Migration logic in %post will cause issues with SELinux
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: jsegitz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Migration logic in %post will cause issues with SELinux

184 %post
185 %define migrated conman_user_migrated
186 %fillup_only conman
187 %if 0%{?have_systemd}
188 %{?tmpfiles_create:%{tmpfiles_create %{_tmpfilesdir}/%{name}.conf}}
189 %service_add_post conman.service
190 [ -d %_localstatedir/lib/conman ] || mkdir %_localstatedir/lib/conman |=
| :
191 if [ $1 -eq 2 -a ! -e %_localstatedir/lib/conman/%migrated ]; then
192     tmpfile=3D$(mktemp /tmp/tmp-XXXX)
193     sed  -e "s@^\(server\)\|\(SERVER\) \+logdir=3D.*@SERVER
logdir=3D\"/var/log/%{?conmandir}\"@" \
194         -e "s@^\(server\)\|\(SERVER\) \+logfile=3D.*@SERVER
logfile=3D\"/var/log/%{?conmandir}conman.log\"@" \
195         -e "s@^\(server\)\|\(SERVER\) \+pidfile=3D.*@SERVER
pidfile=3D\"/var/run/%{?conmandir}conman.pid\"@" \
196         < /etc/conman.conf > $tmpfile
197     if ! cmp /etc/conman.conf $tmpfile; then
198         mv /etc/conman.conf /etc/conman.conf.rpmsave
199         mv $tmpfile /etc/conman.conf
200         chown %conman_u:%conman_g /etc/conman.conf

$tmpfile will receive an SELinux type for temporary files, which will be ke=
pt
if moved with mv. Please either use mv -z or work in place.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17363401331.D327.107
Date: Wed, 8 Jan 2025 12:42:13 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235443

          Summary
          conman: Migration logic in %post will cause issues with SELin=
ux

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          eich@suse.com

          Reporter
          jsegitz@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Migration logic in %post will cause issues with SELinux

184 %post
185 %define migrated conman_user_migrated
186 %fillup_only conman
187 %if 0%{?have_systemd}
188 %{?tmpfiles_create:%{tmpfiles_create %{_tmpfilesdir}/%{name}.conf}}
189 %service_add_post conman.service
190 [ -d %_localstatedir/lib/conman ] || mkdir %_localstatedir/lib/conman |=
| :
191 if [ $1 -eq 2 -a ! -e %_localstatedir/lib/conman/%migrated ]; then
192     tmpfile=3D$(mktemp /tmp/tmp-XXXX)
193     sed  -e "s@^\(server\)\|\(SERVER\) \+logdir=3D.*@SERVER
logdir=3D\"/var/log/%{?conmandir}\"@" \
194         -e "s@^\(server\)\|\(SERVER\) \+logfile=3D.*@SERVER
logfile=3D\"/var/log/%{?conmandir}conman.log\"@" \
195         -e "s@^\(server\)\|\(SERVER\) \+pidfile=3D.*@SERVER
pidfile=3D\"/var/run/%{?conmandir}conman.pid\"@" \
196         < /etc/conman.conf > $tmpfile
197     if ! cmp /etc/conman.conf $tmpfile; then
198         mv /etc/conman.conf /etc/conman.conf.rpmsave
199         mv $tmpfile /etc/conman.conf
200         chown %conman_u:%conman_g /etc/conman.conf

$tmpfile will receive an SELinux type for temporary files, which will be ke=
pt
if moved with mv. Please either use mv -z or work in place.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17363401331.D327.107--


--17363411583.EbFddA.173
Date: Wed, 8 Jan 2025 12:59:18 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235447

            Bug ID: 1235447
           Summary: dhcp: %post server logic might cause issues with SELinux
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: jorik.cronenberg-at-suse.com
          Reporter: jsegitz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Migration logic in %post might cause issues with SELinux

420     if grep -q '^DHCPD_RUN_AS=3D.*nobody' etc/sysconfig/dhcpd; then
421         tmpfile=3D$(mktemp -q etc/sysconfig/dhcpd.XXXXXX)
422         sed 's|^DHCPD_RUN_AS=3D.*|DHCPD_RUN_AS=3D"dhcpd"|' etc/sysconfi=
g/dhcpd
\
423           > $tmpfile && mv $tmpfile etc/sysconfig/dhcpd
424         rm -f $tmpfile
425     fi
426     if grep -q '^DHCPD_BINARY=3D.*dhcpd\..*' etc/sysconfig/dhcpd; then
427         tmpfile=3D$(mktemp -q etc/sysconfig/dhcpd.XXXXXX)
428         sed 's|^DHCPD_BINARY=3D.*|DHCPD_BINARY=3D""|' etc/sysconfig/dhc=
pd \
429           > $tmpfile && mv $tmpfile etc/sysconfig/dhcpd
430         rm -f $tmpfile
431     fi

$tmpfile might receive an incorrect SELinux type for the file, which will be
kept if moved with mv. Please either use mv -Z or work in place.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17363411583.EbFddA.173
Date: Wed, 8 Jan 2025 12:59:18 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235447

          Summary
          dhcp: %post server logic might cause issues with SELinux

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          jorik.cronenberg@suse.com

          Reporter
          jsegitz@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Migration logic in %post might cause issues with SELinux

420     if grep -q '^DHCPD_RUN_AS=3D.*nobody' etc/sysconfig/dhcpd; then
421         tmpfile=3D$(mktemp -q etc/sysconfig/dhcpd.XXXXXX)
422         sed 's|^DHCPD_RUN_AS=3D.*|DHCPD_RUN_AS=3D"dhcpd"|' et=
c/sysconfig/dhcpd
\
423           > $tmpfile && mv $tmpfile etc/sysconfig/dhcpd
424         rm -f $tmpfile
425     fi
426     if grep -q '^DHCPD_BINARY=3D.*dhcpd\..*' etc/sysconfig/dhcpd; then
427         tmpfile=3D$(mktemp -q etc/sysconfig/dhcpd.XXXXXX)
428         sed 's|^DHCPD_BINARY=3D.*|DHCPD_BINARY=3D""|' etc/sys=
config/dhcpd \
429           > $tmpfile && mv $tmpfile etc/sysconfig/dhcpd
430         rm -f $tmpfile
431     fi

$tmpfile might receive an incorrect SELinux type for the file, which will be
kept if moved with mv. Please either use mv -Z or work in place.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17363411583.EbFddA.173--


--17363442732.0cda.368
Date: Wed, 8 Jan 2025 13:51:13 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235453

            Bug ID: 1235453
           Summary: system-user-qemu Installation Failure Due to GID Collision
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: sangeetha.thackarajan-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Fabian Vogt's analysis indicates that system-user-qemu is likely broken. It
attempts to force a GID within the SYS_GID_MIN-SYS_GID_MAX range, which
conflicts with GIDs already used by system-group-hardware.

Can be reproduced with

```
# zypper --installroot $PWD/root in --no-recommends busybox
system-group-hardware

# cat $PWD/root/etc/group
root:x:0:
shadow:x:15:
trusted:x:42:
users:x:100:
kmem:x:101:
lock:x:102:
tty:x:5:
utmp:x:103:
audio:x:104:
cdrom:x:105:
dialout:x:106:
disk:x:107:
input:x:108:
lp:x:109:
render:x:110:
sgx:x:111:
tape:x:112:
video:x:113:
kvm:x:36:

# zypper --installroot $PWD/root in --no-recommends system-user-qemu
...
/usr/bin/busybox addgroup -S -g 107 qemu
addgroup: gid '107' in use
error: %prein(system-user-qemu-20170617-150400.24.2.1.noarch) scriptlet fai=
led,
exit status 1
error: system-user-qemu-20170617-150400.24.2.1.noarch: install failed

# rpm  -ql --scripts system-user-qemu
preinstall scriptlet (using /bin/sh):
/usr/sbin/sysusers2shadow %3 <<"EOF" || [ -f /.buildenv ]
g qemu 107
u qemu 107 "qemu user"
m qemu kvm
EOF

/usr/lib/sysusers.d/system-user-qemu.conf
#
```
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17363442732.0cda.368
Date: Wed, 8 Jan 2025 13:51:13 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235453

          Summary
          system-user-qemu Installation Failure Due to GID Collision

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Tools

          Assignee
          virt-bugs@suse.de

          Reporter
          sangeetha.thackarajan@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Fabian Vogt's analysis indicates that system-user-qemu is li=
kely broken. It
attempts to force a GID within the SYS_GID_MIN-SYS_GID_MAX range, which
conflicts with GIDs already used by system-group-hardware.

Can be reproduced with

```
# zypper --installroot $PWD/root in --no-recommends busybox
system-group-hardware

# cat $PWD/root/etc/group
root:x:0:
shadow:x:15:
trusted:x:42:
users:x:100:
kmem:x:101:
lock:x:102:
tty:x:5:
utmp:x:103:
audio:x:104:
cdrom:x:105:
dialout:x:106:
disk:x:107:
input:x:108:
lp:x:109:
render:x:110:
sgx:x:111:
tape:x:112:
video:x:113:
kvm:x:36:

# zypper --installroot $PWD/root in --no-recommends system-user-qemu
...
/usr/bin/busybox addgroup -S -g 107 qemu
addgroup: gid '107' in use
error: %prein(system-user-qemu-20170617-150400.24.2.1.noarch) scriptlet fai=
led,
exit status 1
error: system-user-qemu-20170617-150400.24.2.1.noarch: install failed

# rpm  -ql --scripts system-user-qemu
preinstall scriptlet (using /bin/sh):
/usr/sbin/sysusers2shadow %3 <<"EOF" || [ -f /.buildenv ]
g qemu 107
u qemu 107 "qemu user"
m qemu kvm
EOF

/usr/lib/sysusers.d/system-user-qemu.conf
#
```

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17363442732.0cda.368--


--17363516110.4ABfC.793
Date: Wed, 8 Jan 2025 15:53:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235477

            Bug ID: 1235477
           Summary: VUL-0: CVE-2025-0218: postgresql-pgagent: When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when ge ...
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/435373/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: alarrosa-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

When batch jobs are executed by pgAgent, a script is created in a temporary
directory and then executed. In versions of pgAgent prior to 4.2.3, an
insufficiently seeded random number generator is used when generating the
directory name, leading to the possibility for a local attacker to pre-crea=
te
the directory and thus prevent pgAgent from executing jobs, disrupting
scheduled tasks.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-0218
https://www.cve.org/CVERecord?id=3DCVE-2025-0218
https://github.com/pgadmin-org/pgagent/commit/1ecd193a2be3a3dc9e98f369495e1=
a792e6d508c
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/0xxx/CVE-2025-=
0218.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17363516110.4ABfC.793
Date: Wed, 8 Jan 2025 15:53:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235477

          Summary
          VUL-0: CVE-2025-0218: postgresql-pgagent: When batch jobs are=
 executed by pgAgent, a script is created in a temporary directory and then=
 executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded =
random number generator is used when ge ...

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/435373/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          alarrosa@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

When batch jobs are executed by pgAgent, a script is created=
 in a temporary
directory and then executed. In versions of pgAgent prior to 4.2.3, an
insufficiently seeded random number generator is used when generating the
directory name, leading to the possibility for a local attacker to pre-crea=
te
the directory and thus prevent pgAgent from executing jobs, disrupting
scheduled tasks.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-0218
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-0218
https://github.com/pgadmin-org/pgagent/commit/1ecd1=
93a2be3a3dc9e98f369495e1a792e6d508c
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/0xxx/CVE-2025-0218.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17363516110.4ABfC.793--


--17365200690.3B7dAf2.1934
Date: Fri, 10 Jan 2025 14:41:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235659

            Bug ID: 1235659
           Summary: fwupd 2.0 polkit-user-privilege and polkit-untracked-privilege
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I have been working on updating fwupd to the 2.0 branch - this mostly works
fine by now

The build succeeds except some rpmlint rules about polkit privileges/additi=
ons,
that need a review:

[  172s] fwupd.x86_64: E: polkit-user-privilege (Badness: 10000)
org.freedesktop.fwupd.emulation-load (auth_admin:no:yes)

[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.quit (auth_admin:no:auth_admin_keep)
[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.reset-config (auth_admin:no:auth_admin_keep)
[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.emulation-save (auth_admin:no:auth_admin_keep)
[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.emulation-tag (auth_admin:no:auth_admin_keep)

The package can be found at
https://build.opensuse.org/package/show/home:dimstar:Factory/fwupd
for now

(builds for openSUSE_Factory in that project succeed, as it does not use the
rpmlint-strict policies; the badness factor is set to 10 in this case)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17365200690.3B7dAf2.1934
Date: Fri, 10 Jan 2025 14:41:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235659

          Summary
          fwupd 2.0 polkit-user-privilege and polkit-untracked-privilege

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I have been working on updating fwupd to the 2.0 branch - th=
is mostly works
fine by now

The build succeeds except some rpmlint rules about polkit privileges/additi=
ons,
that need a review:

[  172s] fwupd.x86_64: E: polkit-user-privilege (Badness: 10000)
org.freedesktop.fwupd.emulation-load (auth_admin:no:yes)

[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.quit (auth_admin:no:auth_admin_keep)
[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.reset-config (auth_admin:no:auth_admin_keep)
[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.emulation-save (auth_admin:no:auth_admin_keep)
[  172s] fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.freedesktop.fwupd.emulation-tag (auth_admin:no:auth_admin_keep)

The package can be found at
https://build.opensuse.org/package/show/home:dimstar:Factory/fwupd
for now

(builds for openSUSE_Factory in that project succeed, as it does not use the
rpmlint-strict policies; the badness factor is set to 10 in this case)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17365200690.3B7dAf2.1934--


--17365969833.BE59.134
Date: Sat, 11 Jan 2025 12:03:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235686

            Bug ID: 1235686
           Summary: Sound from 3.5mm headphone output is mono after deep suspend on Dell Venue 11 Pro 7130
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Sound
          Assignee: tiwai-at-suse.com
          Reporter: andrewthompson1878-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 879541
  --> https://bugzilla.suse.com/attachment.cgi?id=3D879541&action=3Dedit
alsa-info.sh output - before suspend

Sound works properly from both the internal speakers and 3.5mm headphone ou=
tput
prior to suspend. But after resuming from suspend, the sound from the 3.5mm
(wired) headphone output is no longer stereo. It sounds like mono, but I th=
ink
actually one channel is out of phase (because when playing a TV episode the
dialogue is almost inaudible while other sounds are less affected).

It only affects 3.5mm headphone output; internal speakers continue to work
properly. The problem only occurs after resuming from deep suspend, not s2i=
dle.
(I use deep suspend (kernel option mem_sleep_default=3Ddeep) because it con=
sumes
too much battery in s2idle standby.) It does not return to normal until a
reboot.

I will attach alsa-info.sh output before and after suspend.

This is a Dell Venue 11 Pro 7130 (with i3-4020Y CPU). I am currently testin=
g on
a clean install of Tumbleweed (installed from 20250108 snapshot & updated) =
with
GNOME but have previously foudn the same result on KDE Plasma. It also make=
s no
difference whether using Pipewire or Pulse Audio, and all programs using so=
und
are affected, including GNOME or Plasma's Settings "Test Speakers".

I used these tests to reproduce the problem at the ALSA level, all using 3.=
5mm
headphone output:
speaker-test -c2 -t wav
 - Before suspend "front left" is heard in left ear and "front right" is he=
ard
in the right ear as expected.
 - After resuming from suspend, "front left" is heard in both the left & ri=
ght
ear, and "front right" is heard in both left and right ear.

Play a mono wav file (to play same sound in both channels to test for out of
phase i.e. cancellation):
aplay /usr/share/sounds/alsa/Noise.wav
 - Before suspend, this is heard in both left and right ears as expected.
 - After suspend, this is heard only very quietly and only in the right ear.

Play LRMonoPhase4.wav from https://www.kozco.com/tech/soundtests.html:
aplay LRMonoPhase4.wav
 - Before suspend, plays as expected - (1) left channel, (2) right channel,=
 (3)
both channels (centre), (4) the out-of-phase test sounds a bit wrong, all as
expected.
 - After suspend - (1) what should be left is heard in both ears, (2) what
should be right is heard in both ears, (3) the centre test is now extremely
quiet and only in the right ear, (4) the out-of-phase test is no longer out=
 of
phase and sounds normal - all are wrong.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17365969833.BE59.134
Date: Sat, 11 Jan 2025 12:03:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235686

          Summary
          Sound from 3.5mm headphone output is mono after deep suspend =
on Dell Venue 11 Pro 7130

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Minor

          Priority
          P5 - None

          Component
          Sound

          Assignee
          tiwai@suse.com

          Reporter
          andrewthompson1878@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created a=
ttachment 879541 [details]
alsa-info.sh output - before suspend

Sound works properly from both the internal speakers and 3.5mm headphone ou=
tput
prior to suspend. But after resuming from suspend, the sound from the 3.5mm
(wired) headphone output is no longer stereo. It sounds like mono, but I th=
ink
actually one channel is out of phase (because when playing a TV episode the
dialogue is almost inaudible while other sounds are less affected).

It only affects 3.5mm headphone output; internal speakers continue to work
properly. The problem only occurs after resuming from deep suspend, not s2i=
dle.
(I use deep suspend (kernel option mem_sleep_default=3Ddeep) because it con=
sumes
too much battery in s2idle standby.) It does not return to normal until a
reboot.

I will attach alsa-info.sh output before and after suspend.

This is a Dell Venue 11 Pro 7130 (with i3-4020Y CPU). I am currently testin=
g on
a clean install of Tumbleweed (installed from 20250108 snapshot & updat=
ed) with
GNOME but have previously foudn the same result on KDE Plasma. It also make=
s no
difference whether using Pipewire or Pulse Audio, and all programs using so=
und
are affected, including GNOME or Plasma's Settings "Test Speakers&quot=
;.

I used these tests to reproduce the problem at the ALSA level, all using 3.=
5mm
headphone output:
speaker-test -c2 -t wav
 - Before suspend "front left" is heard in left ear and "fro=
nt right" is heard
in the right ear as expected.
 - After resuming from suspend, "front left" is heard in both the=
 left & right
ear, and "front right" is heard in both left and right ear.

Play a mono wav file (to play same sound in both channels to test for out of
phase i.e. cancellation):
aplay /usr/share/sounds/alsa/Noise.wav
 - Before suspend, this is heard in both left and right ears as expected.
 - After suspend, this is heard only very quietly and only in the right ear.

Play LRMonoPhase4.wav from https://www.kozco.com/tech/soundtests.html:
aplay LRMonoPhase4.wav
 - Before suspend, plays as expected - (1) left channel, (2) right channel,=
 (3)
both channels (centre), (4) the out-of-phase test sounds a bit wrong, all as
expected.
 - After suspend - (1) what should be left is heard in both ears, (2) what
should be right is heard in both ears, (3) the centre test is now extremely
quiet and only in the right ear, (4) the out-of-phase test is no longer out=
 of
phase and sounds normal - all are wrong.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17365969833.BE59.134--


--17366491430.5914d51.98
Date: Sun, 12 Jan 2025 02:32:22 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235688

            Bug ID: 1235688
           Summary: [SELinux] APC UPS Daemon blocked from wall broadcast of power outage
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: pallaswept-at-proton.me
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

SELinux status, mode and policy name: enabled, targeted, enforcing
SELinux policy version and repository: 20241216-1.1
The software (incl. version) that is affected by the SELinux issue and the
error message: apcupsd
SELinux Audit log:

SELinux is preventing wall from read access on the directory sessions.

*****  Plugin catchall (100. confidence) suggests   ***********************=
***

If you believe that wall should be allowed read access on the sessions
directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'wall' --raw | audit2allow -M my-wall
# semodule -X 300 -i my-wall.pp

Additional Information:
Source Context                system_u:system_r:apcupsd_t:s0
Target Context                system_u:object_r:systemd_logind_sessions_t:s0
Target Objects                sessions [ dir ]
Source                        wall
Source Path                   wall
Port                          <Unknown>
Host                          Pallas
Source RPM Packages=20=20=20=20=20=20=20=20=20=20=20
Target RPM Packages=20=20=20=20=20=20=20=20=20=20=20
SELinux Policy RPM            selinux-policy-targeted-20241216-1.1.noarch
Local Policy RPM              selinux-policy-targeted-20241216-1.1.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     Pallas
Platform                      Linux Pallas 6.11.8-1-default #1 SMP
                              PREEMPT_DYNAMIC Thu Nov 14 12:54:01 UTC 2024
                              (099023b) x86_64 x86_64
Alert Count                   4
First Seen                    2024-12-18 04:22:21 AEDT
Last Seen                     2025-01-12 12:19:33 AEDT
Local ID                      a6d9ef3d-5ec6-446b-8a63-0e916ef6f994

Raw Audit Messages
type=3DAVC msg=3Daudit(1736644773.411:290): avc:  denied  { read } for  pid=
=3D114261
comm=3D"wall" name=3D"sessions" dev=3D"tmpfs" ino=3D88
scontext=3Dsystem_u:system_r:apcupsd_t:s0
tcontext=3Dsystem_u:object_r:systemd_logind_sessions_t:s0 tclass=3Ddir perm=
issive=3D0

Hash: wall,apcupsd_t,systemd_logind_sessions_t,dir,read
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17366491430.5914d51.98
Date: Sun, 12 Jan 2025 02:32:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235688

          Summary
          [SELinux] APC UPS Daemon blocked from wall broadcast of power=
 outage

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          pallaswept@proton.me

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

SELinux status, mode and policy name: enabled, targeted, enf=
orcing
SELinux policy version and repository: 20241216-1.1
The software (incl. version) that is affected by the SELinux issue and the
error message: apcupsd
SELinux Audit log:

SELinux is preventing wall from read access on the directory sessions.

*****  Plugin catchall (100. confidence) suggests   ***********************=
***

If you believe that wall should be allowed read access on the sessions
directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'wall' --raw | audit2allow -M my-wall
# semodule -X 300 -i my-wall.pp

Additional Information:
Source Context                system_u:system_r:apcupsd_t:s0
Target Context                system_u:object_r:systemd_logind_sessions_t:s0
Target Objects                sessions [ dir ]
Source                        wall
Source Path                   wall
Port                          <Unknown>
Host                          Pallas
Source RPM Packages=20=20=20=20=20=20=20=20=20=20=20
Target RPM Packages=20=20=20=20=20=20=20=20=20=20=20
SELinux Policy RPM            selinux-policy-targeted-20241216-1.1.noarch
Local Policy RPM              selinux-policy-targeted-20241216-1.1.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     Pallas
Platform                      Linux Pallas 6.11.8-1-default #1 SMP
                              PREEMPT_DYNAMIC Thu Nov 14 12:54:01 UTC 2024
                              (099023b) x86_64 x86_64
Alert Count                   4
First Seen                    2024-12-18 04:22:21 AEDT
Last Seen                     2025-01-12 12:19:33 AEDT
Local ID                      a6d9ef3d-5ec6-446b-8a63-0e916ef6f994

Raw Audit Messages
type=3DAVC msg=3Daudit(1736644773.411:290): avc:  denied  { read } for  pid=
=3D114261
comm=3D"wall" name=3D"sessions" dev=3D"tmpfs"=
 ino=3D88
scontext=3Dsystem_u:system_r:apcupsd_t:s0
tcontext=3Dsystem_u:object_r:systemd_logind_sessions_t:s0 tclass=3Ddir perm=
issive=3D0

Hash: wall,apcupsd_t,systemd_logind_sessions_t,dir,read

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17366491430.5914d51.98--


body:
--17366828032.7b0ba5b.50
Date: Sun, 12 Jan 2025 11:53:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235689

            Bug ID: 1235689
           Summary: ghostty files in the terminfo package break ghostty 1.0.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: werner-at-suse.com
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

please skip the intree ghostty files. we provide a terminfo-ghostty package
with the latest files from the ghostty package. actually using ghostty with=
 the
files shipped inside of the terminfo package is broken.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17366828032.7b0ba5b.50
Date: Sun, 12 Jan 2025 11:53:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235689

          Summary
          ghostty files in the terminfo package break ghostty 1.0.1

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          werner@suse.com

          Reporter
          mrueckert@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

please skip the intree ghostty files. we provide a terminfo-=
ghostty package
with the latest files from the ghostty package. actually using ghostty with=
 the
files shipped inside of the terminfo package is broken.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17366828032.7b0ba5b.50--

pkgs: ghostty ncurses


--17367613044.471141d.497
Date: Mon, 13 Jan 2025 09:41:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235709

            Bug ID: 1235709
           Summary: Illegal Instruction in node22 when running virtual machine in qemu-system-s390x
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: S/390-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-suse.de
          Reporter: azouhr-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
                CC: ada.lovelace-at-gmx.de, marcela.maslanova-at-suse.com
  Target Milestone: ---
          Found By: Community User
           Blocker: ---

Created attachment 879555
  --> https://bugzilla.suse.com/attachment.cgi?id=3D879555&action=3Dedit
coredump of yarn install --offline --force

When trying to run a local qemu build of portainer, the build fails during =
the
run of yarn install --offline --force. This is caused by an illegal
instruction, that obviously works fine on real hardware.

[  529.763852] [   T1245] User process fault: interruption code 0001 ilc:1 =
in
node22[1e5edec,2aa21100000+3ba0000]
[  529.766979] [   T1245] CPU: 3 UID: 0 PID: 1245 Comm: node22 Not tainted
6.12.8-2-default #1 openSUSE Tumbleweed
083d7f231fbcde5f6a80c247220bbc54b9c3b34d
[  529.767345] [   T1245] Hardware name: QEMU 8561 QEMU (KVM/Linux)
[  529.767463] [   T1245] User PSW : 0705000180000000 000002aa22f5edec
[  529.767574] [   T1245]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:1 AS=
:0
CC:0 PM:0 RI:0 EA:3
[  529.767637] [   T1245] User GPRS: 0000000000000001 000002aa24d45124
0000000000000000 000003ff00000000
[  529.767675] [   T1245]            000003ff80aea7d3 000003ff80ae7f18
000003ffe32f2870 000003ffe32f2bf8
[  529.767706] [   T1245]            00000000decade11 000003ff80aea910
000002aa2413f1d0 000003ffe32f2730
[  529.767736] [   T1245]            000002aa22177750 0000000000000000
000002aa22f53f22 000003ffe32f2730
[  529.768384] [   T1245] User Code:>000002aa22f5edec: c0e5ff64d142     bra=
sl=20=20
%r14,000002aa21bf9070
                                     000002aa22f5edf2: 0707             bcr=
=20=20=20=20
0,%r7
                                     000002aa22f5edf4: 0707             bcr=
=20=20=20=20
0,%r7
                                     000002aa22f5edf6: 0707             bcr=
=20=20=20=20
0,%r7
                                     000002aa22f5edf8: b3c1000b         ldg=
r=20=20=20
%f0,%r11
                                     000002aa22f5edfc: b90400bf         lgr=
=20=20=20=20
%r11,%r15
                                     000002aa22f5ee00: 0001             unk=
nown
                                     000002aa22f5ee02: b3cd00b0         lgd=
r=20=20=20
%r11,%f0
[  529.768678] [   T1245] Last Breaking-Event-Address:
[  529.768759] [   T1245]  [<000002aa22f5edd4>]
node22[1e5edd4,2aa21100000+3ba0000]

Im running the testbuild of the package home:azouhr:playground/portainer wi=
th
the command

osc build -vm-type qemu openSUSE_Tumbleweed_zSystems s390x

This happens with the cpu set to -cpu qemu as well as -cpu max (changed in
/usr/lib/build/build-vm-qemu). I'll also add the generated coredump, altoug=
h I
don't know if that helps at all.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17367613044.471141d.497
Date: Mon, 13 Jan 2025 09:41:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235709

          Summary
          Illegal Instruction in node22 when running virtual machine in=
 qemu-system-s390x

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          S/390-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KVM

          Assignee
          kvm-bugs@suse.de

          Reporter
          azouhr@opensuse.org

          QA Contact
          qa-bugs@suse.de

          CC
          ada.lovelace@gmx.de, marcela.maslanova@suse.com

          Target Milestone
          ---

          Found By
          Community User

          Blocker
          ---

Created attachment 879555 [details]=

coredump of yarn install --offline --force

When trying to run a local qemu build of portainer, the build fails during =
the
run of yarn install --offline --force. This is caused by an illegal
instruction, that obviously works fine on real hardware.

[  529.763852] [   T1245] User process fault: interruption code 0001 ilc:1 =
in
node22[1e5edec,2aa21100000+3ba0000]
[  529.766979] [   T1245] CPU: 3 UID: 0 PID: 1245 Comm: node22 Not tainted
6.12.8-2-default #1 openSUSE Tumbleweed
083d7f231fbcde5f6a80c247220bbc54b9c3b34d
[  529.767345] [   T1245] Hardware name: QEMU 8561 QEMU (KVM/Linux)
[  529.767463] [   T1245] User PSW : 0705000180000000 000002aa22f5edec
[  529.767574] [   T1245]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:1 AS=
:0
CC:0 PM:0 RI:0 EA:3
[  529.767637] [   T1245] User GPRS: 0000000000000001 000002aa24d45124
0000000000000000 000003ff00000000
[  529.767675] [   T1245]            000003ff80aea7d3 000003ff80ae7f18
000003ffe32f2870 000003ffe32f2bf8
[  529.767706] [   T1245]            00000000decade11 000003ff80aea910
000002aa2413f1d0 000003ffe32f2730
[  529.767736] [   T1245]            000002aa22177750 0000000000000000
000002aa22f53f22 000003ffe32f2730
[  529.768384] [   T1245] User Code:>000002aa22f5edec: c0e5ff64d142     =
brasl=20=20
%r14,000002aa21bf9070
                                     000002aa22f5edf2: 0707             bcr=
=20=20=20=20
0,%r7
                                     000002aa22f5edf4: 0707             bcr=
=20=20=20=20
0,%r7
                                     000002aa22f5edf6: 0707             bcr=
=20=20=20=20
0,%r7
                                     000002aa22f5edf8: b3c1000b         ldg=
r=20=20=20
%f0,%r11
                                     000002aa22f5edfc: b90400bf         lgr=
=20=20=20=20
%r11,%r15
                                     000002aa22f5ee00: 0001             unk=
nown
                                     000002aa22f5ee02: b3cd00b0         lgd=
r=20=20=20
%r11,%f0
[  529.768678] [   T1245] Last Breaking-Event-Address:
[  529.768759] [   T1245]  [<000002aa22f5edd4>]
node22[1e5edd4,2aa21100000+3ba0000]

Im running the testbuild of the package home:azouhr:playground/portainer wi=
th
the command

osc build -vm-type qemu openSUSE_Tumbleweed_zSystems s390x

This happens with the cpu set to -cpu qemu as well as -cpu max (changed in
/usr/lib/build/build-vm-qemu). I'll also add the generated coredump, altoug=
h I
don't know if that helps at all.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17367613044.471141d.497--


--17367652290.E4e07.788
Date: Mon, 13 Jan 2025 10:47:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235724

            Bug ID: 1235724
           Summary: sssd: security related rpmlint warnings in build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: scabrero-at-suse.com
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Split-off from bug 1233131:

We noticed that there are a couple of other rpmlint warnings for the sssd
package that you should checkout:

> sssd.x86_64: W: permissions-missing-verifyscript missing %verify_permissi=
ons -e /usr/libexec/sssd/selinux_child
> sssd.x86_64: W: permissions-missing-verifyscript missing %verify_permissi=
ons -e /usr/libexec/sssd/sssd_pam
> sssd-krb5-common.x86_64: W: permissions-missing-verifyscript missing %ver=
ify_permissions -e /usr/libexec/sssd/krb5_child
> sssd-krb5-common.x86_64: W: permissions-missing-verifyscript missing %ver=
ify_permissions -e /usr/libexec/sssd/ldap_child
> Please add a %verifyscript section

I am seeing the %verify_permissions macro in your current spec file, but
something still seems to be missing here?

> sssd-krb5-common.x86_64: E: missing-call-to-setgroups-before-setuid
/usr/lib64/sssd/libsss_krb5_common.so
> This executable is calling setuid and setgid without setgroups or
> initgroups.
> This means it didn't relinquish all groups, and this would be a potential
> security issue.

I cannot see any setuid() call in the code for this library so it could also
be a false positive.

> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe"/> /usr/share/dbus-1/system.d/org.=
freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Domains"/> /usr/share/dbus-1/syste=
m.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Domains.Domain"/> /usr/share/dbus-=
1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Users"/> /usr/share/dbus-1/system.=
d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Users.User"/> /usr/share/dbus-1/sy=
stem.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Groups"/> /usr/share/dbus-1/system=
.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Groups.Group"/> /usr/share/dbus-1/=
system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Cache"/> /usr/share/dbus-1/system.=
d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Cache.Object"/> /usr/share/dbus-1/=
system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow send_in=
terface=3D"org.freedesktop.sssd.infopipe.Components"/> /usr/share/dbus-1/sy=
stem.d/org.freedesktop.sssd.infopipe.conf
> 'allow' directives must always specify a 'send_destination'.

This seems to be a bug in the upstream
src/responder/ifp/org.freedesktop.sssd.infopipe.conf.in. It means if other
D-Bus service provide the same interface names, then the configuration will
affect them to. This is unlikely to happen, but still unclean. You could
create an upstream bug about this.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17367652290.E4e07.788
Date: Mon, 13 Jan 2025 10:47:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235724

          Summary
          sssd: security related rpmlint warnings in build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          scabrero@suse.com

          Reporter
          matthias.gerstner@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Split-off from bug 1233131:

We noticed that there are a couple of other rpmlint warnings for the sssd
package that you should checkout:

> sssd.x86_64: W: permissions-missing-verifyscript=
 missing %verify_permissions -e /usr/libexec/sssd/selinux_child
> sssd.x86_64: W: permissions-missing-verifyscript missing %verify_permi=
ssions -e /usr/libexec/sssd/sssd_pam
> sssd-krb5-common.x86_64: W: permissions-missing-verifyscript missing %=
verify_permissions -e /usr/libexec/sssd/krb5_child
> sssd-krb5-common.x86_64: W: permissions-missing-verifyscript missing %=
verify_permissions -e /usr/libexec/sssd/ldap_child
> Please add a %verifyscript section

I am seeing the %verify_permissions macro in your current spec file, but
something still seems to be missing here?

> sssd-krb5-common.x86_64: E: missing-call-to-setg=
roups-before-setuid
/usr/lib64/sssd/libsss_krb5_common.so
> This executable is calling setuid and setgid wit=
hout setgroups or
> initgroups.
> This means it didn't relinquish all groups, and this would be a potent=
ial
> security issue.

I cannot see any setuid() call in the code for this library so it could also
be a false positive.

> sssd-dbus.x86_64: E: dbus-policy-allow-without-d=
estination <allow send_interface=3D"org.freedesktop.sssd.infopipe&q=
uot;/> /usr/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Domains"/> /usr=
/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Domains.Domain"/&g=
t; /usr/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Users"/> /usr/s=
hare/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Users.User"/> /=
usr/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Groups"/> /usr/=
share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Groups.Group"/>=
 /usr/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Cache"/> /usr/s=
hare/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Cache.Object"/>=
 /usr/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> sssd-dbus.x86_64: E: dbus-policy-allow-without-destination <allow s=
end_interface=3D"org.freedesktop.sssd.infopipe.Components"/> /=
usr/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
> 'allow' directives must always specify a 'send_destination'.

This seems to be a bug in the upstream
src/responder/ifp/org.freedesktop.sssd.infopipe.conf.in. It means if other
D-Bus service provide the same interface names, then the configuration will
affect them to. This is unlikely to happen, but still unclean. You could
create an upstream bug about this.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17367652290.E4e07.788--


body:
--17367814990.Ef0fdCF.2104
Date: Mon, 13 Jan 2025 15:18:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235794

            Bug ID: 1235794
           Summary: TeXmacs 2.1.4 export fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: asmuth-at-vonasmuth.nl
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Dear Suse,

Writing a document met TexMacs 2.1.4 (TeXmacs-2.1.4-1.2.x86_64) on the curr=
ent
Tumbleweed works, but exporting to Latex or Postscript or PDF is an
indispensable feature which utterly fails with messages saying "warning:
PostScript format no longer supported in Qt5".=20

Output PDF file files are produced, but export seems to stop at included PNG
images.=20

Thanks in advance,

Daniel von Asmuth
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17367814990.Ef0fdCF.2104
Date: Mon, 13 Jan 2025 15:18:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235794

          Summary
          TeXmacs 2.1.4 export fails

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          screening-team-bugs@suse.de

          Reporter
          asmuth@vonasmuth.nl

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Dear Suse,

Writing a document met TexMacs 2.1.4 (TeXmacs-2.1.4-1.2.x86_64) on the curr=
ent
Tumbleweed works, but exporting to Latex or Postscript or PDF is an
indispensable feature which utterly fails with messages saying "warnin=
g:
PostScript format no longer supported in Qt5".=20

Output PDF file files are produced, but export seems to stop at included PNG
images.=20

Thanks in advance,

Daniel von Asmuth

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17367814990.Ef0fdCF.2104--

summary: TeXmacs 2.1.4 export fails


--17367901720.B13fCa78.566
Date: Mon, 13 Jan 2025 17:42:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235805

            Bug ID: 1235805
           Summary: [Build 20250108-SELinux] openQA test fails in quota
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4762579/modules/quot
                    a/steps/32
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Reproducer:

dd if=3D/dev/zero of=3D/tmp/quota.img bs=3D10M count=3D10
mkfs.ext3 -m0 /tmp/quota.img
mkdir /tmp/quota
mount -o loop,rw,usrquota,grpquota /tmp/quota.img /tmp/quota
mkdir /tmp/quota/test-directory; chmod 777 /tmp/quota/test-directory
quotacheck -cug /tmp/quota
useradd -m bernhard
setquota -u bernhard 100 200 6 10 /tmp/quota
systemctl start quotaon\@tmp-quota
systemctl status quotaon\@tmp-quota
sudo ausearch -m avc -ts 18:00

----
time->Mon Jan 13 18:21:20 2025
type=3DAVC msg=3Daudit(1736788880.938:719): avc:  denied  { quotaon } for  =
pid=3D7629
comm=3D"quotaon" name=3D"aquota.group" dev=3D"loop1" ino=3D13
scontext=3Dsystem_u:system_r:quota_t:s0
tcontext=3Dunconfined_u:object_r:unlabeled_t:s0 tclass=3Dfile permissive=3D0
----
time->Mon Jan 13 18:21:20 2025
type=3DAVC msg=3Daudit(1736788880.938:720): avc:  denied  { quotaon } for  =
pid=3D7629
comm=3D"quotaon" name=3D"aquota.user" dev=3D"loop1" ino=3D12
scontext=3Dsystem_u:system_r:quota_t:s0
tcontext=3Dunconfined_u:object_r:unlabeled_t:s0 tclass=3Dfile permissive=3D0

Multiple problems:
1) when quota.img is in /tmp, the default label is <<none>> so no relabelin=
g to
fix it (i would say that is an issue in the test)
2) when quota.img is not in /tmp and not in one of the hardcoded paths (e.g.
mount point is in /root/quota), the user must label like this:
semanage fcontext -a -t quota_db_t /root/quota/aquota.user
semanage fcontext -a -t quota_db_t /root/quota/aquota.group
https://gitlab.suse.de/selinux/selinux-policy/-/blob/factory/policy/modules=
/contrib/quota.if#L134
3) then, when this is done, it does a kmod request (which we will need to f=
ix
on the policy side):
----
time->Mon Jan 13 18:33:16 2025
type=3DAVC msg=3Daudit(1736789596.014:773): avc:  denied  { module_request =
} for=20
pid=3D7801 comm=3D"quotaon" kmod=3D"quota_v2" scontext=3Dsystem_u:system_r:=
quota_t:s0
tcontext=3Dsystem_u:system_r:kernel_t:s0 tclass=3Dsystem permissive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[quota](https://openqa.opensuse.org/tests/4762579/modules/quota/steps/32)

## Test suite description
Maintainer: slindomansilla-at-suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://openqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_textmode&version=3DT=
umbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17367901720.B13fCa78.566
Date: Mon, 13 Jan 2025 17:42:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235805

          Summary
          [Build 20250108-SELinux] openQA test fails in quota

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4762579/modules/quota/steps=
/32

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Reproducer:

dd if=3D/dev/zero of=3D/tmp/quota.img bs=3D10M count=3D10
mkfs.ext3 -m0 /tmp/quota.img
mkdir /tmp/quota
mount -o loop,rw,usrquota,grpquota /tmp/quota.img /tmp/quota
mkdir /tmp/quota/test-directory; chmod 777 /tmp/quota/test-directory
quotacheck -cug /tmp/quota
useradd -m bernhard
setquota -u bernhard 100 200 6 10 /tmp/quota
systemctl start quotaon\@tmp-quota
systemctl status quotaon\@tmp-quota
sudo ausearch -m avc -ts 18:00

----
time->Mon Jan 13 18:21:20 2025
type=3DAVC msg=3Daudit(1736788880.938:719): avc:  denied  { quotaon } for  =
pid=3D7629
comm=3D"quotaon" name=3D"aquota.group" dev=3D"loop=
1" ino=3D13
scontext=3Dsystem_u:system_r:quota_t:s0
tcontext=3Dunconfined_u:object_r:unlabeled_t:s0 tclass=3Dfile permissive=3D0
----
time->Mon Jan 13 18:21:20 2025
type=3DAVC msg=3Daudit(1736788880.938:720): avc:  denied  { quotaon } for  =
pid=3D7629
comm=3D"quotaon" name=3D"aquota.user" dev=3D"loop1=
" ino=3D12
scontext=3Dsystem_u:system_r:quota_t:s0
tcontext=3Dunconfined_u:object_r:unlabeled_t:s0 tclass=3Dfile permissive=3D0

Multiple problems:
1) when quota.img is in /tmp, the default label is <<none>> so =
no relabeling to
fix it (i would say that is an issue in the test)
2) when quota.img is not in /tmp and not in one of the hardcoded paths (e.g.
mount point is in /root/quota), the user must label like this:
semanage fcontext -a -t quota_db_t /root/quota/aquota.user
semanage fcontext -a -t quota_db_t /root/quota/aquota.group
https://gitlab.suse.de/selinux/selinux-p=
olicy/-/blob/factory/policy/modules/contrib/quota.if#L134
3) then, when this is done, it does a kmod request (which we will need to f=
ix
on the policy side):
----
time->Mon Jan 13 18:33:16 2025
type=3DAVC msg=3Daudit(1736789596.014:773): avc:  denied  { module_request =
} for=20
pid=3D7801 comm=3D"quotaon" kmod=3D"quota_v2" scontext=
=3Dsystem_u:system_r:quota_t:s0
tcontext=3Dsystem_u:system_r:kernel_t:s0 tclass=3Dsystem permissive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[quota](https://openqa.opensuse.org/tests/4762579/modules/quota/steps/32<=
/a>)

## Test suite description
Maintainer: slindomansilla&#6=
4;suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://op=
enqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests=
/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D=
64bit&test=3Dextra_tests_textmode&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17367901720.B13fCa78.566--


--17367910673.7e3Efd3.602
Date: Mon, 13 Jan 2025 17:57:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235810

            Bug ID: 1235810
           Summary: VUL-0: CVE-2024-47796: dcmtk: out-of-bounds write due to improper array index validation in the nowindow functionality
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/436052/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: christophe-at-krop.fr
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

An improper array index validation vulnerability exists in the nowindow
functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead=
 to
an out-of-bounds write. An attacker can provide a malicious file to trigger
this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-47796
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/47xxx/CVE-2024=
-47796.json
https://www.cve.org/CVERecord?id=3DCVE-2024-47796
https://git.dcmtk.org/?p=3Ddcmtk.git;a=3Dcommit;h=3D89a6e399f1e17d08a8bc8cd=
aa05b2ac9a50cd4f6
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2122
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2122
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17367910673.7e3Efd3.602
Date: Mon, 13 Jan 2025 17:57:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235810

          Summary
          VUL-0: CVE-2024-47796: dcmtk: out-of-bounds write due to impr=
oper array index validation in the nowindow functionality

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/436052/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          christophe@krop.fr

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

An improper array index validation vulnerability exists in t=
he nowindow
functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead=
 to
an out-of-bounds write. An attacker can provide a malicious file to trigger
this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-47796
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/47xxx/CVE-2024-47796.json
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-47796
https://git.dcmtk.org/?p=3Ddcmtk.git;a=3Dcomm=
it;h=3D89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2122
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024=
-2122

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17367910673.7e3Efd3.602--


--17367912002.28d29f.620
Date: Mon, 13 Jan 2025 18:00:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235811

            Bug ID: 1235811
           Summary: VUL-0: CVE-2024-52333: dcmtk: out-of-bounds write due to improper array index validation in the determineMinMax functionality
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/436062/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: christophe-at-krop.fr
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

An improper array index validation vulnerability exists in the determineMin=
Max
functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead=
 to
an out-of-bounds write. An attacker can provide a malicious file to trigger
this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-52333
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/52xxx/CVE-2024=
-52333.json
https://www.cve.org/CVERecord?id=3DCVE-2024-52333
https://git.dcmtk.org/?p=3Ddcmtk.git;a=3Dcommit;h=3D03e851b0586d05057c32689=
88e180ffb426b2e03
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2121
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2121
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17367912002.28d29f.620
Date: Mon, 13 Jan 2025 18:00:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235811

          Summary
          VUL-0: CVE-2024-52333: dcmtk: out-of-bounds write due to impr=
oper array index validation in the determineMinMax functionality

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/436062/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          christophe@krop.fr

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

An improper array index validation vulnerability exists in t=
he determineMinMax
functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead=
 to
an out-of-bounds write. An attacker can provide a malicious file to trigger
this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-52333
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2024/52xxx/CVE-2024-52333.json
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-52333
https://git.dcmtk.org/?p=3Ddcmtk.git;a=3Dcomm=
it;h=3D03e851b0586d05057c3268988e180ffb426b2e03
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2121
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024=
-2121

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17367912002.28d29f.620--


--17368448056.D18bfa73.272
Date: Tue, 14 Jan 2025 08:53:25 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235829

            Bug ID: 1235829
           Summary: [Build 20250108-SELinux] openQA test fails in systemd_nspawn
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4762579/modules/syst
                    emd_nspawn/steps/142
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1230118
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Reproducer:

zypper -n in systemd-container
zypper -n --root /var/lib/machines/test1 --gpg-auto-import-keys addrepo
http://openqa.opensuse.org/assets/repo/openSUSE-Tumbleweed-oss-x86_64-Snaps=
hot20250108
defaultrepo
zypper -n --root /var/lib/machines/test1 --gpg-auto-import-keys refresh
zypper -n --root /var/lib/machines/test1 install --no-recommends -ly systemd
shadow zypper openSUSE-release
systemctl --no-pager start systemd-nspawn\@test1
systemctl --no-pager status systemd-nspawn\@test1
systemd-run -tM test1 /bin/bash -c date
journalctl -n10 -M test1 | grep 'Reached target Multi-User System'

----
time->Tue Jan 14 09:48:55 2025
type=3DAVC msg=3Daudit(1736844535.757:1171): avc:  denied  { read } for  pi=
d=3D862
comm=3D"dbus-broker" path=3D"/" dev=3D"vda2" ino=3D257
scontext=3Dsystem_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=3Dunconfined_u:object_r:systemd_machined_var_lib_t:s0 tclass=3Ddir
permissive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[systemd_nspawn](https://openqa.opensuse.org/tests/4762579/modules/systemd_=
nspawn/steps/142)

## Test suite description
Maintainer: slindomansilla-at-suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://openqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_textmode&version=3DT=
umbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17368448056.D18bfa73.272
Date: Tue, 14 Jan 2025 08:53:25 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235829

          Summary
          [Build 20250108-SELinux] openQA test fails in systemd_nspawn

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4762579/modules/systemd_nsp=
awn/steps/142

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1230118

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Reproducer:

zypper -n in systemd-container
zypper -n --root /var/lib/machines/test1 --gpg-auto-import-keys addrepo
http://openqa.opensuse.org/assets/repo/openSUSE-Tum=
bleweed-oss-x86_64-Snapshot20250108
defaultrepo
zypper -n --root /var/lib/machines/test1 --gpg-auto-import-keys refresh
zypper -n --root /var/lib/machines/test1 install --no-recommends -ly systemd
shadow zypper openSUSE-release
systemctl --no-pager start systemd-nspawn\@test1
systemctl --no-pager status systemd-nspawn\@test1
systemd-run -tM test1 /bin/bash -c date
journalctl -n10 -M test1 | grep 'Reached target Multi-User System'

----
time->Tue Jan 14 09:48:55 2025
type=3DAVC msg=3Daudit(1736844535.757:1171): avc:  denied  { read } for  pi=
d=3D862
comm=3D"dbus-broker" path=3D"/" dev=3D"vda2" =
ino=3D257
scontext=3Dsystem_u:system_r:system_dbusd_t:s0-s0:c0.c1023
tcontext=3Dunconfined_u:object_r:systemd_machined_var_lib_t:s0 tclass=3Ddir
permissive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[systemd_nspawn](https://openqa.opensuse.org/tests/4762579/modu=
les/systemd_nspawn/steps/142)

## Test suite description
Maintainer: slindomansilla&#6=
4;suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://op=
enqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests=
/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D=
64bit&test=3Dextra_tests_textmode&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17368448056.D18bfa73.272--


--17368537162.2Dc4d.791
Date: Tue, 14 Jan 2025 11:21:56 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235844

            Bug ID: 1235844
           Summary: [Build 20250108-SELinux] openQA test fails in java
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4762579/modules/java
                    /steps/18
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1230118
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Reproducer:
zypper -n install --auto-agree-with-licenses java-*-devel
wget
https://raw.githubusercontent.com/os-autoinst/os-autoinst-distri-opensuse/5=
1421743537f30143d5b8d92fc373dfa1b54fd6a/data/console/test_java.sh
chmod +x test_java.sh
./test_java.sh

More minimal reproducer:
localhost:~ # update-alternatives --set java
/usr/lib64/jvm/jre-11-openjdk/bin/java
update-alternatives: using /usr/lib64/jvm/jre-11-openjdk/bin/java to provide
/usr/bin/java (java) in manual mode
localhost:~ # java -version 2>&1 | awk '/version/{print $3}' | sed 's/"//g'=
 |
awk -F "_" '{print $1}'
11.0.25
localhost:~ # update-alternatives --set java
/usr/lib64/jvm/jre-21-openj9/bin/java
update-alternatives: using /usr/lib64/jvm/jre-21-openj9/bin/java to provide
/usr/bin/java (java) in manual mode
localhost:~ # java -version
libjvm.so
preloadLibrary(/usr/lib64/jvm/java-21-openj9-21/lib/default/libj9vm29.so):
/usr/lib64/jvm/java-21-openj9-21/lib/default/libj9vm29.so: cannot enable
executable stack as shared object requires: Permission denied
libjvm.so failed to load: j9vm29

AVCs:
----
time->Tue Jan 14 12:10:43 2025
type=3DAVC msg=3Daudit(1736853043.955:1251): avc:  denied  { execstack } fo=
r=20
pid=3D21002 comm=3D"java"
scontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=3Dp=
rocess
permissive=3D0
----
time->Tue Jan 14 12:11:54 2025
type=3DAVC msg=3Daudit(1736853114.029:1252): avc:  denied  { execstack } fo=
r=20
pid=3D21032 comm=3D"java"
scontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=3Dp=
rocess
permissive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[java](https://openqa.opensuse.org/tests/4762579/modules/java/steps/18)

## Test suite description
Maintainer: slindomansilla-at-suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://openqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_textmode&version=3DT=
umbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17368537162.2Dc4d.791
Date: Tue, 14 Jan 2025 11:21:56 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235844

          Summary
          [Build 20250108-SELinux] openQA test fails in java

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4762579/modules/java/steps/=
18

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1230118

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Reproducer:
zypper -n install --auto-agree-with-licenses java-*-devel
wget
https://raw.githubusercontent.com/os-autoinst/os-autoinst-distri-opensus=
e/51421743537f30143d5b8d92fc373dfa1b54fd6a/data/console/test_java.sh
chmod +x test_java.sh
./test_java.sh

More minimal reproducer:
localhost:~ # update-alternatives --set java
/usr/lib64/jvm/jre-11-openjdk/bin/java
update-alternatives: using /usr/lib64/jvm/jre-11-openjdk/bin/java to provide
/usr/bin/java (java) in manual mode
localhost:~ # java -version 2>&1 | awk '/version/{print $3}' | sed '=
s/"//g' |
awk -F "_" '{print $1}'
11.0.25
localhost:~ # update-alternatives --set java
/usr/lib64/jvm/jre-21-openj9/bin/java
update-alternatives: using /usr/lib64/jvm/jre-21-openj9/bin/java to provide
/usr/bin/java (java) in manual mode
localhost:~ # java -version
libjvm.so
preloadLibrary(/usr/lib64/jvm/java-21-openj9-21/lib/default/libj9vm29.so):
/usr/lib64/jvm/java-21-openj9-21/lib/default/libj9vm29.so: cannot enable
executable stack as shared object requires: Permission denied
libjvm.so failed to load: j9vm29

AVCs:
----
time->Tue Jan 14 12:10:43 2025
type=3DAVC msg=3Daudit(1736853043.955:1251): avc:  denied  { execstack } fo=
r=20
pid=3D21002 comm=3D"java"
scontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=3Dp=
rocess
permissive=3D0
----
time->Tue Jan 14 12:11:54 2025
type=3DAVC msg=3Daudit(1736853114.029:1252): avc:  denied  { execstack } fo=
r=20
pid=3D21032 comm=3D"java"
scontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=3Dp=
rocess
permissive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[java](https://openqa.opensuse.org/tests/4762579/modules/java/steps/18)

## Test suite description
Maintainer: slindomansilla&#6=
4;suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://op=
enqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests=
/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D=
64bit&test=3Dextra_tests_textmode&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17368537162.2Dc4d.791--


--17368922492.624ACFA.1433
Date: Tue, 14 Jan 2025 22:04:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235871

            Bug ID: 1235871
           Summary: Update nvidia driver to latest 550.144.03 release
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 3rd Party Driver
          Assignee: gfx-bugs-at-suse.de
          Reporter: sndirsch-at-suse.com
        QA Contact: sndirsch-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Update nvidia driver to latest 550.144.03 release
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17368922492.624ACFA.1433
Date: Tue, 14 Jan 2025 22:04:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235871

          Summary
          Update nvidia driver to latest 550.144.03 release

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 3rd Party Driver

          Assignee
          gfx-bugs@suse.de

          Reporter
          sndirsch@suse.com

          QA Contact
          sndirsch@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Update nvidia driver to latest 550.144.03 release

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17368922492.624ACFA.1433--


--17369261681.BBec6f347.90
Date: Wed, 15 Jan 2025 07:29:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1235876

            Bug ID: 1235876
           Summary: VUL-0: CVE-2024-53263: git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/436637/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Git LFS is a Git extension for versioning large files. When Git LFS requests
credentials from Git for a remote host, it passes portions of the host's UR=
L to
the `git-credential(1)` command without checking for embedded line-ending
control characters, and then sends any credentials it receives back from the
Git credential helper to the remote host. By inserting URL-encoded control
characters such as line feed (LF) or carriage return (CR) characters into t=
he
URL, an attacker may be able to retrieve a user's Git credentials. This pro=
blem
exists in all previous versions and is patched in v3.6.1. All users should
upgrade to v3.6.1. There are no workarounds known at this time.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-53263
https://www.cve.org/CVERecord?id=3DCVE-2024-53263
https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f00229=
16a1c90
https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1
https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7
https://bugzilla.redhat.com/show_bug.cgi?id=3D2338002
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17369261681.BBec6f347.90
Date: Wed, 15 Jan 2025 07:29:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1235876

          Summary
          VUL-0: CVE-2024-53263: git-lfs: Git LFS permits exfiltration =
of credentials via crafted HTTP URLs

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/436637/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          abergmann@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Git LFS is a Git extension for versioning large files. When =
Git LFS requests
credentials from Git for a remote host, it passes portions of the host's UR=
L to
the `git-credential(1)` command without checking for embedded line-ending
control characters, and then sends any credentials it receives back from the
Git credential helper to the remote host. By inserting URL-encoded control
characters such as line feed (LF) or carriage return (CR) characters into t=
he
URL, an attacker may be able to retrieve a user's Git credentials. This pro=
blem
exists in all previous versions and is patched in v3.6.1. All users should
upgrade to v3.6.1. There are no workarounds known at this time.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-53263
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-53263
https://github.com/git-lfs/git-lfs/commit/0345b6f816e61=
1d050c0df67b61f0022916a1c90
https://=
github.com/git-lfs/git-lfs/releases/tag/v3.6.1
https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r=
2-x2cc-vrp7
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2338002

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17369261681.BBec6f347.90--