--17301998241.2bcDc.989
Date: Tue, 29 Oct 2024 11:03:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232527

            Bug ID: 1232527
           Summary: [SELinux] "systemd-bless-boot good" fail during boot time
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: danilo.spinella-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Operating System: openSUSE MicroOS
SELinux status, mode and policy name: enabled, enforcing, targeted
SELinux policy version and repository: 20241021-1.1, openSUSE-Tumbleweed-Oss
The software (incl. version) that is affected by the SELinux issue and the
error message: systemd 256.7, systemd-bless-boot, "Failed to rename
'/loader/entries/opensuse-microos-6.11.5-1-default-1+2-1.conf' to
'/loader/entries/opensuse-microos-6.11.5-1-default-1.conf': Permission Deni=
ed"
SELinux Audit log:
type=3DAVC msg=3Daudit(1730195064.486:34): avc:  denied  { rename } for  pi=
d=3D1142
comm=3D"systemd-bless-b" name=3D"opensuse-microos-6.11.5-1-default-1+2-1.co=
nf"
dev=3D"vda2" ino=3D11 scontext=3Dsystem_u:system_r:init_t:s0
tcontext=3Dsystem_u:object_r:dosfs_t:s0 tclass=3Dfile permissive=3D0
Any other important details: N/A
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17301998241.2bcDc.989
Date: Tue, 29 Oct 2024 11:03:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232527

          Summary
          [SELinux] "systemd-bless-boot good" fail during boo=
t time

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          danilo.spinella@suse.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Operating System: openSUSE MicroOS
SELinux status, mode and policy name: enabled, enforcing, targeted
SELinux policy version and repository: 20241021-1.1, openSUSE-Tumbleweed-Oss
The software (incl. version) that is affected by the SELinux issue and the
error message: systemd 256.7, systemd-bless-boot, "Failed to rename
'/loader/entries/opensuse-microos-6.11.5-1-default-1+2-1.conf' to
'/loader/entries/opensuse-microos-6.11.5-1-default-1.conf': Permission Deni=
ed"
SELinux Audit log:
type=3DAVC msg=3Daudit(1730195064.486:34): avc:  denied  { rename } for  pi=
d=3D1142
comm=3D"systemd-bless-b" name=3D"opensuse-microos-6.11.5-1-d=
efault-1+2-1.conf"
dev=3D"vda2" ino=3D11 scontext=3Dsystem_u:system_r:init_t:s0
tcontext=3Dsystem_u:object_r:dosfs_t:s0 tclass=3Dfile permissive=3D0
Any other important details: N/A

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17301998241.2bcDc.989--


--17302064611.1B1Ae5.350
Date: Tue, 29 Oct 2024 12:54:21 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232536

            Bug ID: 1232536
           Summary: bpftrace: ERROR: Error attaching probe: 'kprobe:swap_readpage'
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: petr.vorel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

bpftrace tests on Tumbleweed fails on=20

# echo -e "\ninterval:s:5 { exit(); }" | cat
/usr/share/bpftrace/tools/swapin.bt - | bpftrace -
stdin:1-16: WARNING: swap_readpage is not traceable (either non-existing,
inlined, or marked as "notrace"); attaching to it will likely fail
Attaching 3 probes...
cannot attach kprobe, Invalid argument
ERROR: Error attaching probe: 'kprobe:swap_readpage'
echo $?
255

# bpftrace --info
System
  OS: Linux 6.11.5-1-default #1 SMP PREEMPT_DYNAMIC Wed Oct 23 04:27:11 UTC
2024 (b4e3aa9)
  Arch: x86_64

Build
  version: v0.21.2
  LLVM: 18.1.8
  unsafe probe: no
  bfd: no
  liblldb (DWARF support): yes
  libsystemd (systemd notify support): no

Kernel helpers
  probe_read: yes
  probe_read_str: yes
  probe_read_user: yes
  probe_read_user_str: yes
  probe_read_kernel: yes
  probe_read_kernel_str: yes
  get_current_cgroup_id: yes
  send_signal: yes
  override_return: no
  get_boot_ns: yes
  dpath: yes
  skboutput: yes
  get_tai_ns: yes
  get_func_ip: yes
  jiffies64: yes
  for_each_map_elem: yes

Kernel features
  Instruction limit: 1000000
  Loop support: yes
  btf: yes
  module btf: yes
  map batch: yes
  uprobe refcount (depends on Build:bcc bpf_attach_uprobe refcount): yes

Map types
  hash: yes
  percpu hash: yes
  array: yes
  percpu array: yes
  stack_trace: yes
  perf_event_array: yes
  ringbuf: yes

Probe types
  kprobe: yes
  tracepoint: yes
  perf_event: yes
  kfunc: yes
  kprobe_multi: yes
  uprobe_multi: yes
  raw_tp_special: yes
  iter: yes

Running the same test on Debian with kernel 6.11.5, and with these different
build options it pass:
LLVM: 18.1.8
bfd: no
liblldb (DWARF support): yes
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17302064611.1B1Ae5.350
Date: Tue, 29 Oct 2024 12:54:21 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232536

          Summary
          bpftrace: ERROR: Error attaching probe: 'kprobe:swap_readpage'

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          petr.vorel@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

bpftrace tests on Tumbleweed fails on=20

# echo -e "\ninterval:s:5 { exit(); }" | cat
/usr/share/bpftrace/tools/swapin.bt - | bpftrace -
stdin:1-16: WARNING: swap_readpage is not traceable (either non-existing,
inlined, or marked as "notrace"); attaching to it will likely fail
Attaching 3 probes...
cannot attach kprobe, Invalid argument
ERROR: Error attaching probe: 'kprobe:swap_readpage'
echo $?
255

# bpftrace --info
System
  OS: Linux 6.11.5-1-default #1 SMP PREEMPT_DYNAMIC Wed Oct 23 04:27:11 UTC
2024 (b4e3aa9)
  Arch: x86_64

Build
  version: v0.21.2
  LLVM: 18.1.8
  unsafe probe: no
  bfd: no
  liblldb (DWARF support): yes
  libsystemd (systemd notify support): no

Kernel helpers
  probe_read: yes
  probe_read_str: yes
  probe_read_user: yes
  probe_read_user_str: yes
  probe_read_kernel: yes
  probe_read_kernel_str: yes
  get_current_cgroup_id: yes
  send_signal: yes
  override_return: no
  get_boot_ns: yes
  dpath: yes
  skboutput: yes
  get_tai_ns: yes
  get_func_ip: yes
  jiffies64: yes
  for_each_map_elem: yes

Kernel features
  Instruction limit: 1000000
  Loop support: yes
  btf: yes
  module btf: yes
  map batch: yes
  uprobe refcount (depends on Build:bcc bpf_attach_uprobe refcount): yes

Map types
  hash: yes
  percpu hash: yes
  array: yes
  percpu array: yes
  stack_trace: yes
  perf_event_array: yes
  ringbuf: yes

Probe types
  kprobe: yes
  tracepoint: yes
  perf_event: yes
  kfunc: yes
  kprobe_multi: yes
  uprobe_multi: yes
  raw_tp_special: yes
  iter: yes

Running the same test on Debian with kernel 6.11.5, and with these different
build options it pass:
LLVM: 18.1.8
bfd: no
liblldb (DWARF support): yes

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17302064611.1B1Ae5.350--


--17302140240.45CecA.677
Date: Tue, 29 Oct 2024 15:00:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232541

            Bug ID: 1232541
           Summary: rabbitmq-c: tools can't connect to opensuse instance
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: pgajdos-at-suse.com
          Reporter: amajer-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I cannot connect to our instance of rabbitmq with the sample tools provided,

> amqp-consume -u 'amqps://opensuse:opensuse-at-rabbit.opensuse.org' -e pubsub=
 -x -r '#' /usr/bin/cat
opening socket to rabbit.opensuse.org:5671: SSL peer cert verification fail=
ed

openssl indicates valid certificate,

> cat /dev/null | openssl s_client -status -connect rabbit.opensuse.org:567=
1 -verify 10 | openssl x509 -dates -noout
verify depth is 10
depth=3D2 C =3D US, O =3D Internet Security Research Group, CN =3D ISRG Roo=
t X1
verify return:1
depth=3D1 C =3D US, O =3D Let's Encrypt, CN =3D R10
verify return:1
depth=3D0 CN =3D obs-login.opensuse.org
verify return:1
DONE
notBefore=3DAug 12 00:25:20 2024 GMT
notAfter=3DNov 10 00:25:19 2024 GMT
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17302140240.45CecA.677
Date: Tue, 29 Oct 2024 15:00:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232541

          Summary
          rabbitmq-c: tools can't connect to opensuse instance

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          pgajdos@suse.com

          Reporter
          amajer@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I cannot connect to our instance of rabbitmq with the sample=
 tools provided,

> amqp-consume -u 'amqps://opensuse:opensuse@rabbit.opensuse.org'=
 -e pubsub -x -r '#' /usr/bin/cat
opening socket to rabbit.opensuse.org:5671: SSL peer cert verification fail=
ed

openssl indicates valid certificate,

> cat /dev/null | openssl s_client -status -connec=
t rabbit.opensuse.org:5671 -verify 10 | openssl x509 -dates -noout
verify depth is 10
depth=3D2 C =3D US, O =3D Internet Security Research Group, CN =3D ISRG Roo=
t X1
verify return:1
depth=3D1 C =3D US, O =3D Let's Encrypt, CN =3D R10
verify return:1
depth=3D0 CN =3D obs-login.opensuse.org
verify return:1
DONE
notBefore=3DAug 12 00:25:20 2024 GMT
notAfter=3DNov 10 00:25:19 2024 GMT

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17302140240.45CecA.677--


--17302392932.Ae70Ed.1450
Date: Tue, 29 Oct 2024 22:01:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232566

            Bug ID: 1232566
           Summary: VUL-0: chromium: 130.0.6723.91 stable release
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://chromereleases.googleblog.com/2024/10/stable-c
                    hannel-update-for-desktop_29.html
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: ro-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-des=
ktop_29.html

Fixed in Chromium 130.0.6723.91:=20

* CVE-2024-10487: Out of bounds write in Dawn
* CVE-2024-10488: Use after free in WebRTC
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17302392932.Ae70Ed.1450
Date: Tue, 29 Oct 2024 22:01:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232566

          Summary
          VUL-0: chromium: 130.0.6723.91 stable release

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://chromereleases.googleblog.com/2024/10/stable-channel-=
update-for-desktop_29.html

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          ro@suse.com

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2024/10/stable-channel-update-for-desktop_29.html

Fixed in Chromium 130.0.6723.91:=20

* CVE-2024-10487: Out of bounds write in Dawn
* CVE-2024-10488: Use after free in WebRTC

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17302392932.Ae70Ed.1450--


--17302833013.16AcD.812
Date: Wed, 30 Oct 2024 10:15:01 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232608

            Bug ID: 1232608
           Summary: VUL-0: CVE-2024-50602: audacity: libexpat: DoS via XML_ResumeParser
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/425799/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/
                    S:U/C:N/I:N/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: davejplater-at-gmail.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1232579
  Target Milestone: ---
          Found By: ---
           Blocker: ---

An issue was discovered in libexpat before 2.6.4. There is a crash within t=
he
XML_ResumeParser function because XML_StopParser can stop/suspend an unstar=
ted
parser.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-50602
https://www.cve.org/CVERecord?id=3DCVE-2024-50602
https://github.com/libexpat/libexpat/pull/915
https://bugzilla.redhat.com/show_bug.cgi?id=3D2321987
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17302833013.16AcD.812
Date: Wed, 30 Oct 2024 10:15:01 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232608

          Summary
          VUL-0: CVE-2024-50602: audacity: libexpat: DoS via XML_Resume=
Parser

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/425799/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N=
/I:N/A:H)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          davejplater@gmail.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1232579

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

An issue was discovered in libexpat before 2.6.4. There is a=
 crash within the
XML_ResumeParser function because XML_StopParser can stop/suspend an unstar=
ted
parser.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-50602
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-50602
https://github.co=
m/libexpat/libexpat/pull/915
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2321987

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17302833013.16AcD.812--


--17302832878.AE58D.812
Date: Wed, 30 Oct 2024 10:14:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232580

            Bug ID: 1232580
           Summary: VUL-0: CVE-2024-50602: xsd: libexpat: DoS via XML_ResumeParser
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/425799/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/
                    S:U/C:N/I:N/A:H)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: christophe-at-krop.fr
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1232579
  Target Milestone: ---
          Found By: ---
           Blocker: ---

An issue was discovered in libexpat before 2.6.4. There is a crash within t=
he
XML_ResumeParser function because XML_StopParser can stop/suspend an unstar=
ted
parser.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-50602
https://www.cve.org/CVERecord?id=3DCVE-2024-50602
https://github.com/libexpat/libexpat/pull/915
https://bugzilla.redhat.com/show_bug.cgi?id=3D2321987
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17302832878.AE58D.812
Date: Wed, 30 Oct 2024 10:14:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232580

          Summary
          VUL-0: CVE-2024-50602: xsd: libexpat: DoS via XML_ResumeParser

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/425799/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N=
/I:N/A:H)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          christophe@krop.fr

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1232579

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

An issue was discovered in libexpat before 2.6.4. There is a=
 crash within the
XML_ResumeParser function because XML_StopParser can stop/suspend an unstar=
ted
parser.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-50602
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-50602
https://github.co=
m/libexpat/libexpat/pull/915
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2321987

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17302832878.AE58D.812--


--17303037470.c2a3DeDA.520
Date: Wed, 30 Oct 2024 15:55:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232635

            Bug ID: 1232635
           Summary: VUL-0: CVE-2024-3935: mosquitto: double free and subsequent crash when running under bridge mode and processing remote connections
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/426290/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mardnh-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto bro=
ker
is configured to create an outgoing bridge connection, and that bridge
connection has an incoming topic configured that makes use of topic remappi=
ng,
then if the remote connection sends a crafted PUBLISH packet to the broker a
double free will occur with a subsequent crash of the broker.

References:
https://mosquitto.org/blog/2024/10/version-2-0-19-released/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-3935
https://www.cve.org/CVERecord?id=3DCVE-2024-3935
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17303037470.c2a3DeDA.520
Date: Wed, 30 Oct 2024 15:55:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232635

          Summary
          VUL-0: CVE-2024-3935: mosquitto: double free and subsequent c=
rash when running under bridge mode and processing remote connections

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/426290/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          mardnh@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if =
a Mosquitto broker
is configured to create an outgoing bridge connection, and that bridge
connection has an incoming topic configured that makes use of topic remappi=
ng,
then if the remote connection sends a crafted PUBLISH packet to the broker a
double free will occur with a subsequent crash of the broker.

References:
htt=
ps://mosquitto.org/blog/2024/10/version-2-0-19-released/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-3935
https://www.cv=
e.org/CVERecord?id=3DCVE-2024-3935
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/=
197

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17303037470.c2a3DeDA.520--


--17303039342.9c1ad.532
Date: Wed, 30 Oct 2024 15:58:54 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232636

            Bug ID: 1232636
           Summary: VUL-0: CVE-2024-10525: mosquitto: from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe ...
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/426289/
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: mardnh-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious bro=
ker
sends a crafted SUBACK packet with no reason codes, a client using libmosqu=
itto
may make out of bounds memory access when acting in its on_subscribe callba=
ck.
This affects the mosquitto_sub and mosquitto_rr clients.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-10525
https://www.cve.org/CVERecord?id=3DCVE-2024-10525
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/190
https://mosquitto.org/blog/2024/10/version-2-0-19-released/
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17303039342.9c1ad.532
Date: Wed, 30 Oct 2024 15:58:54 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232636

          Summary
          VUL-0: CVE-2024-10525: mosquitto: from version 1.3.2 through =
2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason =
codes, a client using libmosquitto may make out of bounds memory access whe=
n acting in its on_subscribe ...

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/426289/

          OS
          Other

          Status
          NEW

          Severity
          Critical

          Priority
          P5 - None

          Component
          Security

          Assignee
          mardnh@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if =
a malicious broker
sends a crafted SUBACK packet with no reason codes, a client using libmosqu=
itto
may make out of bounds memory access when acting in its on_subscribe callba=
ck.
This affects the mosquitto_sub and mosquitto_rr clients.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-10525
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-10525
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/=
190
htt=
ps://mosquitto.org/blog/2024/10/version-2-0-19-released/

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17303039342.9c1ad.532--


--17303403424.d818cE.1198
Date: Thu, 31 Oct 2024 02:05:42 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232647

            Bug ID: 1232647
           Summary: AUDIT-WHITELIST: sddm-kalpa whitelist of dbus configuration file
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: sfalken@cloverleaf-linux.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Can I please get a review, and a whitelist, based on the following:

[   97s] sddm-kalpa.x86_64: E: dbus-file-unauthorized (Badness: 10)
/usr/share/dbus-1/system.d/org.freedesktop.DisplayManager-sddm.conf (sha256
file digest default
filter:daa7d493ab968d706530339465449d98e09a5f717c230b85bf0f0e3d1365de2c she=
ll
filter:b3416d1bd9f087c9be887c1610296a116cb16a5f04e81fc0d61275ccbbc99842 xml
filter:4b4cbecadaf6124b64d65abcc27157a154f4f3544b1a68b1f0754282e6766c8f)
[   97s] Packaging D-Bus services requires a review and whitelisting by the
SUSE
[   97s] security team. If the package is intended for inclusion in any SUSE
product
[   97s] please open a bug report to request review of the package by the
security
[   97s] team. Please refer to
[   97s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   97s] more information.

Package is
https://build.opensuse.org/package/show/devel:microos:kalpa/sddm-kalpa
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17303403424.d818cE.1198
Date: Thu, 31 Oct 2024 02:05:42 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232647

          Summary
          AUDIT-WHITELIST: sddm-kalpa whitelist of dbus configuration f=
ile

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          sfalken@cloverleaf-linux.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Can I please get a review, and a whitelist, based on the fol=
lowing:

[   97s] sddm-kalpa.x86_64: E: dbus-file-unauthorized (Badness: 10)
/usr/share/dbus-1/system.d/org.freedesktop.DisplayManager-sddm.conf (sha256
file digest default
filter:daa7d493ab968d706530339465449d98e09a5f717c230b85bf0f0e3d1365de2c she=
ll
filter:b3416d1bd9f087c9be887c1610296a116cb16a5f04e81fc0d61275ccbbc99842 xml
filter:4b4cbecadaf6124b64d65abcc27157a154f4f3544b1a68b1f0754282e6766c8f)
[   97s] Packaging D-Bus services requires a review and whitelisting by the
SUSE
[   97s] security team. If the package is intended for inclusion in any SUSE
product
[   97s] please open a bug report to request review of the package by the
security
[   97s] team. Please refer to
[   97s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
[   97s] more information.

Package is
https://build.opensuse.org/package/show/devel:microos:kalpa/sddm-ka=
lpa

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17303403424.d818cE.1198--


--17303731192.E60b6B8.683
Date: Thu, 31 Oct 2024 11:11:59 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232670

            Bug ID: 1232670
           Summary: [SELinux] importctl cannot write to /var/lib/extensions
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Importing sysext images with importctl does not work, since SELinux blocks
writing in that directory:

node122:~ # importctl pull-raw --class=3Dsysext
https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20=
.2.x86-64.raw
--verify=3Dno
Enqueued transfer job 1. Press C-c to continue download in background.
Pulling
'https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-2=
0.2.x86-64.raw',
saving as 'gcc-20.2.x86-64'.
Operating on image directory '/var/lib/extensions'.
Failed to create /var/lib/extensions/.#verityebe0580e99f54026: Permission
denied
Verity integrity file could not be retrieved, proceeding without.
Failed to create /var/lib/extensions/.#roothash96cdb063d430dc58: Permission
denied
Root hash file could not be retrieved, proceeding without.
Failed to create /var/lib/extensions/.#roothash.p7s70c3902ea1954e95: Permis=
sion
denied
Root hash signature file could not be retrieved, proceeding without.
Downloading 241.2M for
https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20=
.2.x86-64.raw.
Failed to create /var/lib/extensions/.#rawd292069b0f58e5ea: Permission deni=
ed
Failed to retrieve image file.
Exiting.

type=3DSERVICE_START msg=3Daudit(1730372760.872:336): pid=3D1 uid=3D0 auid=
=3D4294967295
ses=3D4294967295 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'unit=3Dsystemd-i=
mportd
comm=3D"systemd" exe=3D"/usr/lib/systemd/systemd" hostname=3D? addr=3D? ter=
minal=3D?
res=3Dsuccess'
type=3DAVC msg=3Daudit(1730372764.279:337): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"dm-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DAVC msg=3Daudit(1730372764.282:338): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"dm-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DAVC msg=3Daudit(1730372764.289:339): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"dm-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DAVC msg=3Daudit(1730372767.479:340): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"dm-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DSERVICE_STOP msg=3Daudit(1730372797.529:341): pid=3D1 uid=3D0 auid=
=3D4294967295
ses=3D4294967295 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'unit=3Dsystemd-i=
mportd
comm=3D"systemd" exe=3D"/usr/lib/systemd/systemd" hostname=3D? addr=3D? ter=
minal=3D?
res=3Dsuccess'
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17303731192.E60b6B8.683
Date: Thu, 31 Oct 2024 11:11:59 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232670

          Summary
          [SELinux] importctl cannot write to /var/lib/extensions

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          kukuk@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Importing sysext images with importctl does not work, since =
SELinux blocks
writing in that directory:

node122:~ # importctl pull-raw --class=3Dsysext
https://download.opensuse.org/repositories/home:/=
kukuk:/sysext/mkosi/gcc-20.2.x86-64.raw
--verify=3Dno
Enqueued transfer job 1. Press C-c to continue download in background.
Pulling
'https://download.opensuse.org/repositories/home:=
/kukuk:/sysext/mkosi/gcc-20.2.x86-64.raw',
saving as 'gcc-20.2.x86-64'.
Operating on image directory '/var/lib/extensions'.
Failed to create /var/lib/extensions/.#verityebe0580e99f54026: Permission
denied
Verity integrity file could not be retrieved, proceeding without.
Failed to create /var/lib/extensions/.#roothash96cdb063d430dc58: Permission
denied
Root hash file could not be retrieved, proceeding without.
Failed to create /var/lib/extensions/.#roothash.p7s70c3902ea1954e95: Permis=
sion
denied
Root hash signature file could not be retrieved, proceeding without.
Downloading 241.2M for
https://download.opensuse.org/repositories/home:/=
kukuk:/sysext/mkosi/gcc-20.2.x86-64.raw.
Failed to create /var/lib/extensions/.#rawd292069b0f58e5ea: Permission deni=
ed
Failed to retrieve image file.
Exiting.

type=3DSERVICE_START msg=3Daudit(1730372760.872:336): pid=3D1 uid=3D0 auid=
=3D4294967295
ses=3D4294967295 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'unit=3Dsystemd-i=
mportd
comm=3D"systemd" exe=3D"/usr/lib/systemd/systemd" hostn=
ame=3D? addr=3D? terminal=3D?
res=3Dsuccess'
type=3DAVC msg=3Daudit(1730372764.279:337): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"d=
m-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DAVC msg=3Daudit(1730372764.282:338): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"d=
m-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DAVC msg=3Daudit(1730372764.289:339): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"d=
m-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DAVC msg=3Daudit(1730372767.479:340): avc:  denied  { write } for  pi=
d=3D2413
comm=3D"systemd-pull" name=3D"extensions" dev=3D"d=
m-0" ino=3D143939
scontext=3Dsystem_u:system_r:systemd_importd_t:s0
tcontext=3Dunconfined_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0
type=3DSERVICE_STOP msg=3Daudit(1730372797.529:341): pid=3D1 uid=3D0 auid=
=3D4294967295
ses=3D4294967295 subj=3Dsystem_u:system_r:init_t:s0 msg=3D'unit=3Dsystemd-i=
mportd
comm=3D"systemd" exe=3D"/usr/lib/systemd/systemd" hostn=
ame=3D? addr=3D? terminal=3D?
res=3Dsuccess'

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17303731192.E60b6B8.683--


--17305430873.349DAC46.101
Date: Sat, 2 Nov 2024 10:24:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232726

            Bug ID: 1232726
           Summary: nscd crashes when libvirt_guest is added to the "hosts" service provider
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: srinidhi.bs-at-microfocus.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 878341
  --> https://bugzilla.suse.com/attachment.cgi?id=3D878341&action=3Dedit
coredump file

nscd crashes very frequently whe the `/etc/nsswitch.conf` contains the
following line:

> hosts:          files libvirt libvirt_guest mdns_minimal [NOTFOUND=3Dretu=
rn] DNS

System details:

> $ screenfetch -n -d '-host'
>  OS: openSUSE 20241031
>  Kernel: x86_64 Linux 6.11.5-1-default
>  Uptime: 25m
>  Packages: 3892
>  Shell: bash 5.2.37
>  Resolution: 5040x1920
>  DE: GNOME 47.1.1
>  WM: Mutter
>  WM Theme: Dracula
>  GTK Theme: Adwaita [GTK2/3]
>  Icon Theme: Adwaita
>  Font: Cantarell 11
>  Disk: 1.5T / 2.0T (78%)
>  CPU: Intel Core i7-10850H @ 12x 5.1GHz [57.0=C2=B0C]
>  GPU: Mesa Intel(R) UHD Graphics (CML GT2)
>  RAM: 7761MiB / 64043MiB

> $ rpm -qa libvirt-*
> libvirt-daemon-driver-nodedev-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-core-10.8.0-2.1.x86_64
> libvirt-daemon-lock-10.8.0-2.1.x86_64
> libvirt-daemon-log-10.8.0-2.1.x86_64
> libvirt-glib-1_0-0-5.0.0-2.1.x86_64
> libvirt-nss-10.8.0-2.1.x86_64
> libvirt-libs-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-rbd-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-iscsi-direct-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-mpath-10.8.0-2.1.x86_64
> libvirt-client-10.8.0-2.1.x86_64
> libvirt-daemon-proxy-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-logical-10.8.0-2.1.x86_64
> libvirt-daemon-driver-secret-10.8.0-2.1.x86_64
> libvirt-daemon-common-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-scsi-10.8.0-2.1.x86_64
> libvirt-daemon-10.8.0-2.1.x86_64
> libvirt-daemon-config-network-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-iscsi-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-disk-10.8.0-2.1.x86_64
> libvirt-daemon-qemu-10.8.0-2.1.x86_64
> libvirt-daemon-driver-qemu-10.8.0-2.1.x86_64
> libvirt-daemon-driver-network-10.8.0-2.1.x86_64
> libvirt-daemon-plugin-lockd-10.8.0-2.1.x86_64
> libvirt-daemon-driver-nwfilter-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-10.8.0-2.1.x86_64

> $  rpm -qi glibc
> Name        : glibc
> Version     : 2.40
> Release     : 2.1
> Architecture: x86_64
> Install Date: Tue 15 Oct 2024 11:57:27 PM IST
> Group       : System/Libraries
> Size        : 7096270
> License     : GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.1-or-late=
r WITH GCC-exception-2.0
> Signature   : RSA/SHA512, Thu 03 Oct 2024 01:15:51 AM IST, Key ID 35a2f86=
e29b700a4
> Source RPM  : glibc-2.40-2.1.src.rpm
> Build Date  : Tue 01 Oct 2024 02:26:18 AM IST
> Build Host  : reproducible
> Packager    : https://bugs.opensuse.org
> Vendor      : openSUSE
> URL         : https://www.gnu.org/software/libc/libc.html
> Summary     : Standard Shared Libraries (from the GNU C Library)
> Description :
> The GNU C Library provides the most important standard libraries used
> by nearly all programs: the standard C library, the standard math
> library, and the POSIX thread library. A system is not functional
> without these libraries.
> Distribution: openSUSE Tumbleweed

> $ rpm -qi libvirt-nss
> Name        : libvirt-nss
> Version     : 10.8.0
> Release     : 2.1
> Architecture: x86_64
> Install Date: Sat 02 Nov 2024 03:35:30 PM IST
> Group       : Unspecified
> Size        : 44992
> License     : LGPL-2.1-or-later
> Signature   : RSA/SHA512, Thu 24 Oct 2024 12:50:49 AM IST, Key ID 35a2f86=
e29b700a4
> Source RPM  : libvirt-10.8.0-2.1.src.rpm
> Build Date  : Tue 22 Oct 2024 09:29:15 PM IST
> Build Host  : reproducible
> Packager    : https://bugs.opensuse.org
> Vendor      : openSUSE
> URL         : https://libvirt.org/
> Summary     : Libvirt plugin for Name Service Switch
> Description :
> libvirt plugin for NSS for translating domain names into IP addresses.
> Distribution: openSUSE Tumbleweed

> $ rpm -qfi /lib64/libjson-c.so.5
> Name        : libjson-c5
> Version     : 0.17
> Release     : 2.3
> Architecture: x86_64
> Install Date: Tue Apr  2 08:59:48 2024
> Group       : System/Libraries
> Size        : 74263
> License     : MIT
> Signature   : RSA/SHA512, Fri Mar 29 19:03:54 2024, Key ID 35a2f86e29b700=
a4
> Source RPM  : json-c-0.17-2.3.src.rpm
> Build Date  : Wed Dec  6 20:56:31 2023
> Build Host  : reproducible
> Packager    : https://bugs.opensuse.org
> Vendor      : openSUSE
> URL         : https://github.com/json-c/json-c
> Summary     : JSON-C shared library
> Description :
> JSON-C implements a reference counting object model that allows you to
> easily construct JSON objects in C, output them as JSON formatted
> strings and parse JSON formatted strings back into the C
> representation of JSON objects.
>=20
> This package includes the JSON library.
> Distribution: openSUSE Tumbleweed

The full output of the `coredumpctl info 6029` is mentioned below. I am also
attaching the zst file for your reference.

> $ coredumpctl info 6029
>            PID: 6029 (nscd)
>            UID: 471 (nscd)
>            GID: 471 (nscd)
>         Signal: 11 (SEGV)
>      Timestamp: Sat 2024-11-02 15:23:09 IST (18min ago)
>   Command Line: /usr/sbin/nscd
>     Executable: /usr/sbin/nscd
>  Control Group: /system.slice/nscd.service
>           Unit: nscd.service
>          Slice: system.slice
>        Boot ID: c7dca555cfe14e869c5e40761982b36b
>     Machine ID: d8e3bf9576304874a24b06e33799a8e5
>       Hostname: srinidhi
>        Storage: /var/lib/systemd/coredump/core.nscd.471.c7dca555cfe14e869=
c5e40761982b36b.6029.1730541189000000.zst (inaccessible)
>        Message: Process 6029 (nscd) of user 471 dumped core.
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6038:
>                 #0  0x00007f8fb20274c9 json_tokener_free (libjson-c.so.5 =
+ 0xb4c9)
>                 #1  0x00007f8fb2017c70 n/a (libnss_libvirt_guest.so.2 + 0=
x2c70)
>                 #2  0x00007f8fb2017e48 n/a (libnss_libvirt_guest.so.2 + 0=
x2e48)
>                 #3  0x00007f8fb2018571 _nss_libvirt_guest_gethostbyname4_=
r (libnss_libvirt_guest.so.2 + 0x3571)
>                 #4  0x0000555713ab14c9 n/a (nscd + 0x154c9)
>                 #5  0x0000555713ab25a2 n/a (nscd + 0x165a2)
>                 #6  0x0000555713aa6424 n/a (nscd + 0xa424)
>                 #7  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #8  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6033:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@@GLIBC_2.3.=
2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6031:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@@GLIBC_2.3.=
2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6029:
>                 #0  0x00007f8fb1f1da76 epoll_wait (libc.so.6 + 0x11da76)
>                 #1  0x0000555713aa6e0e n/a (nscd + 0xae0e)
>                 #2  0x0000555713aa78b8 n/a (nscd + 0xb8b8)
>                 #3  0x0000555713aa2a9f n/a (nscd + 0x6a9f)
>                 #4  0x00007f8fb1e2a2ae __libc_start_call_main (libc.so.6 =
+ 0x2a2ae)
>                 #5  0x00007f8fb1e2a379 __libc_start_main@@GLIBC_2.34 (lib=
c.so.6 + 0x2a379)
>                 #6  0x0000555713aa2f25 n/a (nscd + 0x6f25)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6032:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@@GLIBC_2.3.=
2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6036:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIBC_2.3.2 (li=
bc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6037:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIBC_2.3.2 (li=
bc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6039:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIBC_2.3.2 (li=
bc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6040:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIBC_2.3.2 (li=
bc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6034:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@@GLIBC_2.3.=
2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6035:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (libc=
.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@@GLIBC_2.3.=
2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>                 ELF object binary architecture: AMD x86-64
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17305430873.349DAC46.101
Date: Sat, 2 Nov 2024 10:24:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232726

          Summary
          nscd crashes when libvirt_guest is added to the "hosts&q=
uot; service provider

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Other

          Assignee
          virt-bugs@suse.de

          Reporter
          srinidhi.bs@microfocus.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 878341 [details]
coredump file

nscd crashes very frequently whe the `/etc/nsswitch.conf` contains the
following line:

> hosts:          files libvirt libvirt_guest mdns=
_minimal [NOTFOUND=3Dreturn] DNS

System details:

> $ screenfetch -n -d '-host'
>  OS: openSUSE 20241031
>  Kernel: x86_64 Linux 6.11.5-1-default
>  Uptime: 25m
>  Packages: 3892
>  Shell: bash 5.2.37
>  Resolution: 5040x1920
>  DE: GNOME 47.1.1
>  WM: Mutter
>  WM Theme: Dracula
>  GTK Theme: Adwaita [GTK2/3]
>  Icon Theme: Adwaita
>  Font: Cantarell 11
>  Disk: 1.5T / 2.0T (78%)
>  CPU: Intel Core i7-10850H @ 12x 5.1GHz [57.0=C2=B0C]
>  GPU: Mesa Intel(R) UHD Graphics (CML GT2)
>  RAM: 7761MiB / 64043MiB

> $ rpm -qa libvirt-*
> libvirt-daemon-driver-nodedev-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-core-10.8.0-2.1.x86_64
> libvirt-daemon-lock-10.8.0-2.1.x86_64
> libvirt-daemon-log-10.8.0-2.1.x86_64
> libvirt-glib-1_0-0-5.0.0-2.1.x86_64
> libvirt-nss-10.8.0-2.1.x86_64
> libvirt-libs-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-rbd-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-iscsi-direct-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-mpath-10.8.0-2.1.x86_64
> libvirt-client-10.8.0-2.1.x86_64
> libvirt-daemon-proxy-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-logical-10.8.0-2.1.x86_64
> libvirt-daemon-driver-secret-10.8.0-2.1.x86_64
> libvirt-daemon-common-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-scsi-10.8.0-2.1.x86_64
> libvirt-daemon-10.8.0-2.1.x86_64
> libvirt-daemon-config-network-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-iscsi-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-disk-10.8.0-2.1.x86_64
> libvirt-daemon-qemu-10.8.0-2.1.x86_64
> libvirt-daemon-driver-qemu-10.8.0-2.1.x86_64
> libvirt-daemon-driver-network-10.8.0-2.1.x86_64
> libvirt-daemon-plugin-lockd-10.8.0-2.1.x86_64
> libvirt-daemon-driver-nwfilter-10.8.0-2.1.x86_64
> libvirt-daemon-driver-storage-10.8.0-2.1.x86_64

> $  rpm -qi glibc
> Name        : glibc
> Version     : 2.40
> Release     : 2.1
> Architecture: x86_64
> Install Date: Tue 15 Oct 2024 11:57:27 PM IST
> Group       : System/Libraries
> Size        : 7096270
> License     : GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.1-or-l=
ater WITH GCC-exception-2.0
> Signature   : RSA/SHA512, Thu 03 Oct 2024 01:15:51 AM IST, Key ID 35a2=
f86e29b700a4
> Source RPM  : glibc-2.40-2.1.src.rpm
> Build Date  : Tue 01 Oct 2024 02:26:18 AM IST
> Build Host  : reproducible
> Packager    : https://bugs.opens=
use.org
> Vendor      : openSUSE
> URL         : =
https://www.gnu.org/software/libc/libc.html
> Summary     : Standard Shared Libraries (from the GNU C Library)
> Description :
> The GNU C Library provides the most important standard libraries used
> by nearly all programs: the standard C library, the standard math
> library, and the POSIX thread library. A system is not functional
> without these libraries.
> Distribution: openSUSE Tumbleweed

> $ rpm -qi libvirt-nss
> Name        : libvirt-nss
> Version     : 10.8.0
> Release     : 2.1
> Architecture: x86_64
> Install Date: Sat 02 Nov 2024 03:35:30 PM IST
> Group       : Unspecified
> Size        : 44992
> License     : LGPL-2.1-or-later
> Signature   : RSA/SHA512, Thu 24 Oct 2024 12:50:49 AM IST, Key ID 35a2=
f86e29b700a4
> Source RPM  : libvirt-10.8.0-2.1.src.rpm
> Build Date  : Tue 22 Oct 2024 09:29:15 PM IST
> Build Host  : reproducible
> Packager    : https://bugs.opens=
use.org
> Vendor      : openSUSE
> URL         : https://libvirt.org/
> Summary     : Libvirt plugin for Name Service Switch
> Description :
> libvirt plugin for NSS for translating domain names into IP addresses.
> Distribution: openSUSE Tumbleweed

> $ rpm -qfi /lib64/libjson-c.so.5
> Name        : libjson-c5
> Version     : 0.17
> Release     : 2.3
> Architecture: x86_64
> Install Date: Tue Apr  2 08:59:48 2024
> Group       : System/Libraries
> Size        : 74263
> License     : MIT
> Signature   : RSA/SHA512, Fri Mar 29 19:03:54 2024, Key ID 35a2f86e29b=
700a4
> Source RPM  : json-c-0.17-2.3.src.rpm
> Build Date  : Wed Dec  6 20:56:31 2023
> Build Host  : reproducible
> Packager    : https://bugs.opens=
use.org
> Vendor      : openSUSE
> URL         : https://git=
hub.com/json-c/json-c
> Summary     : JSON-C shared library
> Description :
> JSON-C implements a reference counting object model that allows you to
> easily construct JSON objects in C, output them as JSON formatted
> strings and parse JSON formatted strings back into the C
> representation of JSON objects.
>=20
> This package includes the JSON library.
> Distribution: openSUSE Tumbleweed

The full output of the `coredumpctl info 6029` is mentioned below. I am also
attaching the zst file for your reference.

> $ coredumpctl info 6029
>            PID: 6029 (nscd)
>            UID: 471 (nscd)
>            GID: 471 (nscd)
>         Signal: 11 (SEGV)
>      Timestamp: Sat 2024-11-02 15:23:09 IST (18min ago)
>   Command Line: /usr/sbin/nscd
>     Executable: /usr/sbin/nscd
>  Control Group: /system.slice/nscd.service
>           Unit: nscd.service
>          Slice: system.slice
>        Boot ID: c7dca555cfe14e869c5e40761982b36b
>     Machine ID: d8e3bf9576304874a24b06e33799a8e5
>       Hostname: srinidhi
>        Storage: /var/lib/systemd/coredump/core.nscd.471.c7dca555cfe14e=
869c5e40761982b36b.6029.1730541189000000.zst (inaccessible)
>        Message: Process 6029 (nscd) of user 471 dumped core.
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6038:
>                 #0  0x00007f8fb20274c9 json_tokener_free (libjson-c.so=
.5 + 0xb4c9)
>                 #1  0x00007f8fb2017c70 n/a (libnss_libvirt_guest.so.2 =
+ 0x2c70)
>                 #2  0x00007f8fb2017e48 n/a (libnss_libvirt_guest.so.2 =
+ 0x2e48)
>                 #3  0x00007f8fb2018571 _nss_libvirt_guest_gethostbynam=
e4_r (libnss_libvirt_guest.so.2 + 0x3571)
>                 #4  0x0000555713ab14c9 n/a (nscd + 0x154c9)
>                 #5  0x0000555713ab25a2 n/a (nscd + 0x165a2)
>                 #6  0x0000555713aa6424 n/a (nscd + 0xa424)
>                 #7  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #8  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6033:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@&#64=
;GLIBC_2.3.2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6031:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@&#64=
;GLIBC_2.3.2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6029:
>                 #0  0x00007f8fb1f1da76 epoll_wait (libc.so.6 + 0x11da7=
6)
>                 #1  0x0000555713aa6e0e n/a (nscd + 0xae0e)
>                 #2  0x0000555713aa78b8 n/a (nscd + 0xb8b8)
>                 #3  0x0000555713aa2a9f n/a (nscd + 0x6a9f)
>                 #4  0x00007f8fb1e2a2ae __libc_start_call_main (libc.so=
.6 + 0x2a2ae)
>                 #5  0x00007f8fb1e2a379 __libc_start_main@@GLIB=
C_2.34 (libc.so.6 + 0x2a379)
>                 #6  0x0000555713aa2f25 n/a (nscd + 0x6f25)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6032:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@&#64=
;GLIBC_2.3.2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6036:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIB=
C_2.3.2 (libc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6037:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIB=
C_2.3.2 (libc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6039:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIB=
C_2.3.2 (libc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6040:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97520 pthread_cond_wait@@GLIB=
C_2.3.2 (libc.so.6 + 0x97520)
>                 #2  0x0000555713aa5aeb n/a (nscd + 0x9aeb)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6034:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@&#64=
;GLIBC_2.3.2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>                 Stack trace of thread 6035:
>                 #0  0x00007f8fb1e946be __futex_abstimed_wait_common (l=
ibc.so.6 + 0x946be)
>                 #1  0x00007f8fb1e97845 pthread_cond_timedwait@&#64=
;GLIBC_2.3.2 (libc.so.6 + 0x97845)
>                 #2  0x0000555713aa3cd2 n/a (nscd + 0x7cd2)
>                 #3  0x00007f8fb1e983b2 start_thread (libc.so.6 + 0x983=
b2)
>                 #4  0x00007f8fb1f1d5fc __clone3 (libc.so.6 + 0x11d5fc)
>                 ELF object binary architecture: AMD x86-64</pr=
e>

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17305430873.349DAC46.101--


--17305601800.F484De8.155
Date: Sat, 2 Nov 2024 15:09:40 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232727

            Bug ID: 1232727
           Summary: [Build 20241101] openQA test fails in boot_encrypt: no decrypt prompt
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4612221/modules/boot
                    _encrypt/steps/3
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

This started failing with the latest snapshot
One possible change is the removal of the fbdev device which might be neede=
d by
grub/Plymouth to show the password dialog=20

There is no evidence so far - just a hunch=20

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-crypt_no_lvm@64bit f=
ails
in
[boot_encrypt](https://openqa.opensuse.org/tests/4612221/modules/boot_encry=
pt/steps/3)

## Test suite description
Maintainer: riafarov. Test installation with encrypted partitions but witho=
ut
lvm enabled. This is supported only by storage-ng, hence, do NOT enable test
suite on distris without storage-ng.

## Reproducible

Fails since (at least) Build
[20241101](https://openqa.opensuse.org/tests/4611783)

## Expected result

Last good: [20241031](https://openqa.opensuse.org/tests/4608797) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dcrypt_no_lvm&version=3DTumblewee=
d)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17305601800.F484De8.155
Date: Sat, 2 Nov 2024 15:09:40 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232727

          Summary
          [Build 20241101] openQA test fails in boot_encrypt: no decryp=
t prompt

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4612221/modules/boot_encryp=
t/steps/3

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

This started failing with the latest snapshot
One possible change is the removal of the fbdev device which might be neede=
d by
grub/Plymouth to show the password dialog=20

There is no evidence so far - just a hunch=20

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-crypt_no_lvm@64b=
it fails
in
[boot_encrypt](https://openqa.opensuse.org/tests/4612221/modules/bo=
ot_encrypt/steps/3)

## Test suite description
Maintainer: riafarov. Test installation with encrypted partitions but witho=
ut
lvm enabled. This is supported only by storage-ng, hence, do NOT enable test
suite on distris without storage-ng.

## Reproducible

Fails since (at least) Build
[20241101](https://op=
enqa.opensuse.org/tests/4611783)

## Expected result

Last good: [20241031](https://openqa.opensuse.org/tests/4608797) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?=
arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D64bit&am=
p;test=3Dcrypt_no_lvm&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17305601800.F484De8.155--


--17305616271.D8e458.169
Date: Sat, 2 Nov 2024 15:33:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232728

            Bug ID: 1232728
           Summary: No audio from guests after update to qemu 9.1.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: oliver-at-schwabedissen.name
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hello,

after updating qemu from 9.1.0-2.1 to qemu-9.1.1-1.1 (snapshot 20241030) I =
lost
sound in all guests (Windows 10, Ubuntu 24.04).

I downgraded qemu to 9.1.0-2.1 and sound is working again.

System has 2 audio devices, I'm using the Onboard audio (Family 17h).

hwinfo --sound
19: PCI d00.3: 0403 Audio device=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  [Created at pci.386]
  Unique ID: FRmF.ziY0svRSom2
  Parent ID: JZZT.XtQqpuv2hW0
  SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:0d:00.3
  SysFS BusID: 0000:0d:00.3
  Hardware Class: sound
  Model: "AMD Family 17h (Models 00h-0fh) HD Audio Controller"
  Vendor: pci 0x1022 "AMD"
  Device: pci 0x1457 "Family 17h (Models 00h-0fh) HD Audio Controller"
  SubVendor: pci 0x1043 "ASUSTeK Computer Inc."
  SubDevice: pci 0x8723=20
  Driver: "snd_hda_intel"
  Driver Modules: "snd_hda_intel"
  Memory Range: 0xfce00000-0xfce07fff (rw,non-prefetchable)
  IRQ: 100 (3463 events)
  Module Alias: "pci:v00001022d00001457sv00001043sd00008723bc04sc03i00"
  Driver Info #0:
    Driver Status: snd_hda_intel is active
    Driver Activation Cmd: "modprobe snd_hda_intel"
  Config Status: cfg=3Dnew, avail=3Dyes, need=3Dno, active=3Dunknown
  Attached to: #31 (PCI bridge)

38: PCI b00.1: 0403 Audio device
  [Created at pci.386]
  Unique ID: 94OI.b0tOCU4_vDC
  Parent ID: cuhJ.CS5kfnTSviA
  SysFS ID:
/devices/pci0000:00/0000:00:03.1/0000:09:00.0/0000:0a:00.0/0000:0b:00.1
  SysFS BusID: 0000:0b:00.1
  Hardware Class: sound
  Model: "ATI Navi 21 HDMI Audio [Radeon RX 6800/6800 XT / 6900 XT]"
  Vendor: pci 0x1002 "ATI Technologies Inc"
  Device: pci 0xab28 "Navi 21 HDMI Audio [Radeon RX 6800/6800 XT / 6900 XT]"
  SubVendor: pci 0x1002 "ATI Technologies Inc"
  SubDevice: pci 0xab28=20
  Driver: "snd_hda_intel"
  Driver Modules: "snd_hda_intel"
  Memory Range: 0xfc920000-0xfc923fff (rw,non-prefetchable)
  IRQ: 99 (217 events)
  Module Alias: "pci:v00001002d0000AB28sv00001002sd0000AB28bc04sc03i00"
  Driver Info #0:
    Driver Status: snd_hda_intel is active
    Driver Activation Cmd: "modprobe snd_hda_intel"
  Config Status: cfg=3Dnew, avail=3Dyes, need=3Dno, active=3Dunknown
  Attached to: #24 (PCI bridge)

In Windows VMs I configured HDA (ICH9) as audio device.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17305616271.D8e458.169
Date: Sat, 2 Nov 2024 15:33:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232728

          Summary
          No audio from guests after update to qemu 9.1.1

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Other

          Assignee
          virt-bugs@suse.de

          Reporter
          oliver@schwabedissen.name

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hello,

after updating qemu from 9.1.0-2.1 to qemu-9.1.1-1.1 (snapshot 20241030) I =
lost
sound in all guests (Windows 10, Ubuntu 24.04).

I downgraded qemu to 9.1.0-2.1 and sound is working again.

System has 2 audio devices, I'm using the Onboard audio (Family 17h).

hwinfo --sound
19: PCI d00.3: 0403 Audio device=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  [Created at pci.386]
  Unique ID: FRmF.ziY0svRSom2
  Parent ID: JZZT.XtQqpuv2hW0
  SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:0d:00.3
  SysFS BusID: 0000:0d:00.3
  Hardware Class: sound
  Model: "AMD Family 17h (Models 00h-0fh) HD Audio Controller"
  Vendor: pci 0x1022 "AMD"
  Device: pci 0x1457 "Family 17h (Models 00h-0fh) HD Audio Controller&=
quot;
  SubVendor: pci 0x1043 "ASUSTeK Computer Inc."
  SubDevice: pci 0x8723=20
  Driver: "snd_hda_intel"
  Driver Modules: "snd_hda_intel"
  Memory Range: 0xfce00000-0xfce07fff (rw,non-prefetchable)
  IRQ: 100 (3463 events)
  Module Alias: "pci:v00001022d00001457sv00001043sd00008723bc04sc03i00=
"
  Driver Info #0:
    Driver Status: snd_hda_intel is active
    Driver Activation Cmd: "modprobe snd_hda_intel"
  Config Status: cfg=3Dnew, avail=3Dyes, need=3Dno, active=3Dunknown
  Attached to: #31 (PCI bridge)

38: PCI b00.1: 0403 Audio device
  [Created at pci.386]
  Unique ID: 94OI.b0tOCU4_vDC
  Parent ID: cuhJ.CS5kfnTSviA
  SysFS ID:
/devices/pci0000:00/0000:00:03.1/0000:09:00.0/0000:0a:00.0/0000:0b:00.1
  SysFS BusID: 0000:0b:00.1
  Hardware Class: sound
  Model: "ATI Navi 21 HDMI Audio [Radeon RX 6800/6800 XT / 6900 XT]&qu=
ot;
  Vendor: pci 0x1002 "ATI Technologies Inc"
  Device: pci 0xab28 "Navi 21 HDMI Audio [Radeon RX 6800/6800 XT / 690=
0 XT]"
  SubVendor: pci 0x1002 "ATI Technologies Inc"
  SubDevice: pci 0xab28=20
  Driver: "snd_hda_intel"
  Driver Modules: "snd_hda_intel"
  Memory Range: 0xfc920000-0xfc923fff (rw,non-prefetchable)
  IRQ: 99 (217 events)
  Module Alias: "pci:v00001002d0000AB28sv00001002sd0000AB28bc04sc03i00=
"
  Driver Info #0:
    Driver Status: snd_hda_intel is active
    Driver Activation Cmd: "modprobe snd_hda_intel"
  Config Status: cfg=3Dnew, avail=3Dyes, need=3Dno, active=3Dunknown
  Attached to: #24 (PCI bridge)

In Windows VMs I configured HDA (ICH9) as audio device.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17305616271.D8e458.169--


body:
--17307193444.ABbcD8f.746
Date: Mon, 4 Nov 2024 11:22:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232750

            Bug ID: 1232750
           Summary: python310:doc : FTBFS-j1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mcepl-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
our python310 doc multibuild fails on 1-core-VM:

osc build --noservice --vm-type=3Dkvm -M=3Ddoc --clean -j1 standard

fails with
[   82s] Warning, treated as error:
[   82s]
/home/abuild/rpmbuild/BUILD/Python-3.10.15/Doc/library/email.message.rst:4:=
duplicate
object description of email.message, other instance in
library/email.compat32-message, use :no-index: for one of them
[   95s] make: *** [Makefile:52: build] Error 2
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17307193444.ABbcD8f.746
Date: Mon, 4 Nov 2024 11:22:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232750

          Summary
          python310:doc : FTBFS-j1

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          All

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          mcepl@suse.com

          Reporter
          bwiedemann@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          Development

          Blocker
          ---

While working on reproducible builds for openSUSE, I found t=
hat
our python310 doc multibuild fails on 1-core-VM:

osc build --noservice --vm-type=3Dkvm -M=3Ddoc --clean -j1 standard

fails with
[   82s] Warning, treated as error:
[   82s]
/home/abuild/rpmbuild/BUILD/Python-3.10.15/Doc/library/email.message.rst:4:=
duplicate
object description of email.message, other instance in
library/email.compat32-message, use :no-index: for one of them
[   95s] make: *** [Makefile:52: build] Error 2

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17307193444.ABbcD8f.746--

summary: python310:doc : FTBFS-j1


--17307733682.b6FE864EB.287
Date: Tue, 5 Nov 2024 02:22:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232776

            Bug ID: 1232776
           Summary: AUDIT-1: supergfxctl: review of D-Bus service supergfxd.service
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: R_Nik_C-at-proton.me
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

For my package found in OBS in hardware:supergfxctl I would like a whitelis=
ting
for the following rpmlint error:

<relevant output from build log>

> supergfxctl.x86_64: E: dbus-file-unauthorized (Badness: 10000) /etc/dbus-=
1/system.d/org.supergfxctl.Daemon.conf (sha256 file digest default filter:1=
44bf742215f74f9d7da0876430e3942241d6df3a27bf4cf9945a461d905ce85 shell filte=
r:144bf742215f74f9d7da0876430e3942241d6df3a27bf4cf9945a461d905ce85 xml filt=
er:feeda577d27ded2d0d252d626bfc897a687d81aa1ee0f334cfb997151e40969b)

P.S.
I just wanted to submit new package in factory sr#1221280 and this is requi=
red
for next steps.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17307733682.b6FE864EB.287
Date: Tue, 5 Nov 2024 02:22:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232776

          Summary
          AUDIT-1: supergfxctl: review of D-Bus service supergfxd.servi=
ce

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          R_Nik_C@proton.me

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

For my package found in OBS in hardware:supergfxctl I would =
like a whitelisting
for the following rpmlint error:

<relevant output from build log>

> supergfxctl.x86_64: E: dbus-file-unauthorized (B=
adness: 10000) /etc/dbus-1/system.d/org.supergfxctl.Daemon.conf (sha256 fil=
e digest default filter:144bf742215f74f9d7da0876430e3942241d6df3a27bf4cf994=
5a461d905ce85 shell filter:144bf742215f74f9d7da0876430e3942241d6df3a27bf4cf=
9945a461d905ce85 xml filter:feeda577d27ded2d0d252d626bfc897a687d81aa1ee0f33=
4cfb997151e40969b)

P.S.
I just wanted to submit new package in factory sr#1221280 and this is requi=
red
for next steps.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17307733682.b6FE864EB.287--


--17308288133.0a8Ab.1451
Date: Tue, 5 Nov 2024 17:46:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232835

            Bug ID: 1232835
           Summary: AUDIT-0: upower: Review of new polkit policy (battery charge limit)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: bjorn.lie-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

New version of upower brings a new polkit policy, please review

New package can be found in=20

https://build.opensuse.org/package/show/GNOME:Next/upower

[   18s] upower.x86_64: E: polkit-user-privilege (Badness: 10000)
org.freedesktop.UPower.enable-charging-limit (no:no:yes)
[   18s] The package allows unprivileged users to carry out privileged
operations
[   18s] without root authentication.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17308288133.0a8Ab.1451
Date: Tue, 5 Nov 2024 17:46:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232835

          Summary
          AUDIT-0: upower: Review of new polkit policy (battery charge =
limit)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          bjorn.lie@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

New version of upower brings a new polkit policy, please rev=
iew

New package can be found in=20

https=
://build.opensuse.org/package/show/GNOME:Next/upower

[   18s] upower.x86_64: E: polkit-user-privilege (Badness: 10000)
org.freedesktop.UPower.enable-charging-limit (no:no:yes)
[   18s] The package allows unprivileged users to carry out privileged
operations
[   18s] without root authentication.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17308288133.0a8Ab.1451--


--17308313592.9d6f1C8E.1481
Date: Tue, 5 Nov 2024 18:29:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232837

            Bug ID: 1232837
           Summary: rpm sometimes need multiple cpu minutes to update a single rpm package
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: koenig-at-linux.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

rpm-4.19.1.1-3.4.x86_64

recently almost every day running "zypper dup --allow-vendor-change" very f=
ew
rpm packages need *multiple* CPU minutes to update (small) packages.
that always seems to happen at 50% mark for verbose updates:

current example:
(66/99) Installing: gcc15-objc-15.0.0+git4948-134.1.x86_64
.............................................................<50%>=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D[\]

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     3256771 85.7  0.0  93920 27032 pts/2    R+   19:02   4:16 rpm --ro=
ot /
--dbpath /usr/lib/sysimage/rpm --define _dump_posttrans 1 -U --percent --no=
glob
--force --nodeps


--17308454922.9f726aA1.1667
Date: Tue, 5 Nov 2024 22:24:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232843

            Bug ID: 1232843
           Summary: VUL-0: chromium: 130.0.6723.116 stable release
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: ro-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-des=
ktop.html

CVE-2024-10826: Use after free in Family Experiences
CVE-2024-10827: Use after free in Serial
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17308454922.9f726aA1.1667
Date: Tue, 5 Nov 2024 22:24:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232843

          Summary
          VUL-0: chromium: 130.0.6723.116 stable release

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          ro@suse.com

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.com/=
2024/11/stable-channel-update-for-desktop.html

CVE-2024-10826: Use after free in Family Experiences
CVE-2024-10827: Use after free in Serial

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17308454922.9f726aA1.1667--


--17308951994.cfB51.6404
Date: Wed, 6 Nov 2024 12:13:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232906

            Bug ID: 1232906
           Summary: ppc64(le) isn't building the latest bpftrace due unresolvable lldb-devel
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: PowerPC-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: petr.vorel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Originally found in https://bugzilla.suse.com/show_bug.cgi?id=3D1224403#c8

https://build.opensuse.org/projects/devel:tools/packages/bpftrace/repositor=
ies/openSUSE_Factory_PowerPC/binaries

"unresolvable: nothing provides lldb-devel"
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17308951994.cfB51.6404
Date: Wed, 6 Nov 2024 12:13:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232906

          Summary
          ppc64(le) isn't building the latest bpftrace due unresolvable=
 lldb-devel

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          PowerPC-64

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          petr.vorel@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Originally found in https://bugzilla.suse.com/show_bug=
.cgi?id=3D1224403#c8

https://build.opensuse.or=
g/projects/devel:tools/packages/bpftrace/repositories/openSUSE_Factory_Powe=
rPC/binaries

"unresolvable: nothing provides lldb-devel"

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17308951994.cfB51.6404--


--17309054355.Beb6.7661
Date: Wed, 6 Nov 2024 15:03:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1232948

            Bug ID: 1232948
           Summary: VUL-0: CVE-2024-51744: trivy: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/426863/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-51744:3.1:(AV:N/AC:H/PR:N/UI:R/
                    S:U/C:L/I:N/A:N)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1232936
  Target Milestone: ---
          Found By: ---
           Blocker: ---

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation=
 of
the error behavior in `ParseWithClaims` can lead to situation where users a=
re
potentially not checking errors in the way they should be. Especially, if a
token is both expired and invalid, the errors returned by `ParseWithClaims`
return both error codes. If users only check for the `jwt.ErrTokenExpired `
using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInval=
id`
and thus potentially accept invalid tokens. A fix has been back-ported with=
 the
error handling logic from the `v5` branch to the `v4` branch. In this logic,
the `ParseWithClaims` function will immediately return in "dangerous"
situations (e.g., an invalid signature), limiting the combined errors only =
to
situations where the signature is valid, but further validation failed (e.g=
.,
if the signature is valid, but is expired AND has the wrong audience). This=
 fix
is part of the 4.5.1 release. We are aware that this changes the behaviour =
of
an established function and is not 100 % backwards compatible, so updating =
to
4.5.1 might break your code. In case you cannot update to 4.5.0, please make
sure that you are properly checking for all errors ("dangerous" ones first)=
, so
that you are not running in the case detailed above.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-51744
https://www.cve.org/CVERecord?id=3DCVE-2024-51744
https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d19706=
0c1c2c
https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r
https://bugzilla.redhat.com/show_bug.cgi?id=3D2323735
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17309054355.Beb6.7661
Date: Wed, 6 Nov 2024 15:03:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1232948

          Summary
          VUL-0: CVE-2024-51744: trivy: github.com/golang-jwt/jwt/v4: B=
ad documentation of error handling in ParseWithClaims can lead to potential=
ly dangerous situations in golang-jwt

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/426863/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-51744:3.1:(AV:N/AC:H/PR:N/UI:R/S:U/C:L=
/I:N/A:N)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1232936

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

golang-jwt is a Go implementation of JSON Web Tokens. Unclea=
r documentation of
the error behavior in `ParseWithClaims` can lead to situation where users a=
re
potentially not checking errors in the way they should be. Especially, if a
token is both expired and invalid, the errors returned by `ParseWithClaims`
return both error codes. If users only check for the `jwt.ErrTokenExpired `
using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInval=
id`
and thus potentially accept invalid tokens. A fix has been back-ported with=
 the
error handling logic from the `v5` branch to the `v4` branch. In this logic,
the `ParseWithClaims` function will immediately return in "dangerous&q=
uot;
situations (e.g., an invalid signature), limiting the combined errors only =
to
situations where the signature is valid, but further validation failed (e.g=
.,
if the signature is valid, but is expired AND has the wrong audience). This=
 fix
is part of the 4.5.1 release. We are aware that this changes the behaviour =
of
an established function and is not 100 % backwards compatible, so updating =
to
4.5.1 might break your code. In case you cannot update to 4.5.0, please make
sure that you are properly checking for all errors ("dangerous" o=
nes first), so
that you are not running in the case detailed above.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-51744
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-51744
https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c=
79bbdb40e4ce7d197060c1c2c
https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-=
vh33-7x7r
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2323735

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17309054355.Beb6.7661--