--17006581040.7fDD.11674
Date: Wed, 22 Nov 2023 13:01:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217402

            Bug ID: 1217402
           Summary: AUDIT-FIND: Updating server configuration as root while parsing untrusted data
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: fstrba-at-suse.com
          Reporter: jsegitz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

With the new tomcat10 packages I stumbled across:

687 %post webapps
688 %{serverxmltool} add-context.xslt docBase=3D%{tomcatappdir}/ROOT path=
=3D/
689 %{serverxmltool} add-context.xslt docBase=3D%{tomcatappdir}/sample
path=3D/sample
690 %{serverxmltool} add-context.xslt docBase=3D%{tomcatappdir}/examples
path=3D/examples

This translates to e.g.
/usr/libexec/tomcat/serverxml-tool.sh add-context.xslt
docBase=3D/usr/share/tomcat/tomcat-webapps/ROOT path=3D/

serverxml-tool.sh invokes java with serverxmltool.jar to update
/etc/tomcat/server.xml. All of this runs as root and parses XML. I didn't f=
ind
a security issue with this (but also just spend a couple of minutes on this=
),
but it's a bigger risk than necessary. Apart from overwriting the config fi=
le
root privileges are not needed. Especially the java call should not run as
root, xml operations are notoriously dangerous.

runuser is a good tool for this. You can do the XML parsing as the tomcat u=
ser
and then if necessary overwrite the tomcat config with an update file.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17006581040.7fDD.11674
Date: Wed, 22 Nov 2023 13:01:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217402

          Summary
          AUDIT-FIND: Updating server configuration as root while parsi=
ng untrusted data

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          fstrba@suse.com

          Reporter
          jsegitz@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

With the new tomcat10 packages I stumbled across:

687 %post webapps
688 %{serverxmltool} add-context.xslt docBase=3D%{tomcatappdir}/ROOT path=
=3D/
689 %{serverxmltool} add-context.xslt docBase=3D%{tomcatappdir}/sample
path=3D/sample
690 %{serverxmltool} add-context.xslt docBase=3D%{tomcatappdir}/examples
path=3D/examples

This translates to e.g.
/usr/libexec/tomcat/serverxml-tool.sh add-context.xslt
docBase=3D/usr/share/tomcat/tomcat-webapps/ROOT path=3D/

serverxml-tool.sh invokes java with serverxmltool.jar to update
/etc/tomcat/server.xml. All of this runs as root and parses XML. I didn't f=
ind
a security issue with this (but also just spend a couple of minutes on this=
),
but it's a bigger risk than necessary. Apart from overwriting the config fi=
le
root privileges are not needed. Especially the java call should not run as
root, xml operations are notoriously dangerous.

runuser is a good tool for this. You can do the XML parsing as the tomcat u=
ser
and then if necessary overwrite the tomcat config with an update file.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17006581040.7fDD.11674--


body:
Build Identifier:=20

We run K8s clusters using MicroOS for the nodes. K8s is provisioned with
Terraform on Hetzner cloud platform using kube-hetzner Terraform module.

Clusters ran fine for about six months with automatic upgrades and rebooting
controlled using Kured.

On November 16th the automatic upgrade failed on all nodes.

On reboot after transactional-update ran:

- /.snapshots is not mounted and empty
- health-checker fails due to this
- kubelet does not start
- later transactional-update runs
- it performs an "unused snapshot cleanup" and removes **all snapshots** fr=
om
the filesystem
- on next reboot the node is dead - no root filesystem present anymore

This is the corresponding log output from transactional-update after the fi=
rst
boot:

Nov 19 00:34:02 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:
Creating a new grub2 config
Nov 19 00:34:02 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
2023-11-19 00:34:02 tukit 4.4.0 started
Nov 19 00:34:02 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
2023-11-19 00:34:02 Options: call 52 bash -c /usr/sbin/grub2-mkconfig >
/boot/grub2/grub.cfg
Nov 19 00:34:03 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
/var/lib/kubelet/pods not reset as customized by admin to
unconfined_u:object_r:container_file_t:s0
Nov 19 00:34:03 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
/var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayf=
s/snapshots
not reset as customized by admin to unconfined_u:object_r:cont>
Nov 19 00:34:03 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
2023-11-19 00:34:03 Executing `bash -c /usr/sbin/grub2-mkconfig >
/boot/grub2/grub.cfg`:
Nov 19 00:34:03 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
Generating grub configuration file ...
Nov 19 00:34:03 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: Fou=
nd
theme: /boot/grub2/themes/openSUSE/theme.txt
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: Fou=
nd
linux image: /boot/vmlinuz-6.6.1-1-default
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: Fou=
nd
initrd image: /boot/initrd-6.6.1-1-default
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
Warning: os-prober will not be executed to detect other bootable partitions.
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: Sys=
tems
on them will not be added to the GRUB boot configuration.
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: Che=
ck
GRUB_DISABLE_OS_PROBER documentation entry.
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: Add=
ing
boot menu entry for UEFI Firmware Settings ...
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]: done
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
2023-11-19 00:34:04 Application returned with exit status 0.
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30290]:
2023-11-19 00:34:04 Transaction completed.
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30938]:
2023-11-19 00:34:04 tukit 4.4.0 started
Nov 19 00:34:04 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30938]:
2023-11-19 00:34:04 Options: close 52
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30938]:
/var/lib/kubelet/pods not reset as customized by admin to
unconfined_u:object_r:container_file_t:s0
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30938]:
/var/lib/rancher/k3s/agent/containerd/io.containerd.snapshotter.v1.overlayf=
s/snapshots
not reset as customized by admin to unconfined_u:object_r:cont>
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30938]:
2023-11-19 00:34:05 New default snapshot is #52 (/.snapshots/52/snapshot).
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[30938]:
2023-11-19 00:34:05 Transaction completed.
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:
Warning: The following files were changed in the snapshot, but are shadowed=
 by
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]: oth=
er
mounts and will not be visible to the system:
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:
/.snapshots/52/snapshot/var/lib/dbus/machine-id
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:
WARNING: This snapshot has been created from a different base (47)
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:=20=
=20=20=20=20=20=20=20
 than the previous default snapshot (51) and does not
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:=20=
=20=20=20=20=20=20=20
 contain the changes from the latter.
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]: New
default snapshot is #52 (/.snapshots/52/snapshot).
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[18583]:
transactional-update finished
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[31158]:
2023-11-19 00:34:05 tukit 4.4.0 started
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[31158]:
2023-11-19 00:34:05 Options: reboot kured
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[31158]:
2023-11-19 00:34:05 Triggering reboot using kured
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt transactional-update[31158]:
2023-11-19 00:34:05 Transaction completed.
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt systemd[1]:
transactional-update.service: Deactivated successfully.
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt systemd[1]: Finished Update the
system.
Nov 19 00:34:05 k8stest1-wk-fsn1-cpx31-xgt systemd[1]:
transactional-update.service: Consumed 1min 15.285s CPU time.

summary: MicroOS upgrade failed and screwed up nodes by deleting the root filesystem completely


--17006905133.262a.12562
Date: Wed, 22 Nov 2023 22:01:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217419

            Bug ID: 1217419
           Summary: mumble doesn't connect to pulseaudio interface
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Sound
          Assignee: tiwai-at-suse.com
          Reporter: M.Traxler-at-gsi.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Unfortunately, now (mumble-1.5.517-1.3) can not connect to the
pulseaudio-server anymore and is not usable as it is.=20
Available connections are: ALSA, Jack, pipewire and portaudio but with none=
 of
them I can get any sound in or out of mumble.=20
There is no "mumble" in the pavucontrol visible.=20

With the snap-version everything still works.
https://snapcraft.io/install/mumble/opensuse
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17006905133.262a.12562
Date: Wed, 22 Nov 2023 22:01:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217419

          Summary
          mumble doesn't connect to pulseaudio interface

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Sound

          Assignee
          tiwai@suse.com

          Reporter
          M.Traxler@gsi.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Unfortunately, now (mumble-1.5.517-1.3) can not connect to t=
he
pulseaudio-server anymore and is not usable as it is.=20
Available connections are: ALSA, Jack, pipewire and portaudio but with none=
 of
them I can get any sound in or out of mumble.=20
There is no "mumble" in the pavucontrol visible.=20

With the snap-version everything still works.
https://snapcraft.=
io/install/mumble/opensuse

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17006905133.262a.12562--


body:
--17007189091.E9eDcb1.12790
Date: Thu, 23 Nov 2023 05:55:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217424

            Bug ID: 1217424
           Summary: node-gyp 21 errors out with SyntaxError
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: brunopitrus-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

After Tumbleweed upgraded to node 21.2.0, the vscode RPM started failing to
build with the following error:

[  258s] Traceback (most recent call last):
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/gyp_main.py", line=
 45,
in <module>
[  258s]     sys.exit(gyp.script_main())
[  258s]              ^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__=
.py",
line 688, in script_main
[  258s]     return main(sys.argv[1:])
[  258s]            ^^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__=
.py",
line 680, in main
[  258s]     return gyp_main(args)
[  258s]            ^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__=
.py",
line 647, in gyp_main
[  258s]     [generator, flat_list, targets, data] =3D Load(
[  258s]                                             ^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__init__=
.py",
line 157, in Load
[  258s]     result =3D gyp.input.Load(
[  258s]              ^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/input.py=
",
line 2987, in Load
[  258s]     LoadTargetBuildFile(
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/input.py=
",
line 400, in LoadTargetBuildFile
[  258s]     build_file_data =3D LoadOneBuildFile(
[  258s]                       ^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/input.py=
",
line 237, in LoadOneBuildFile
[  258s]     build_file_data =3D eval(build_file_contents, {"__builtins__":=
 {}},
None)
[  258s]=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/gyp_main.py", line=
 7
[  258s]     import os
[  258s]     ^^^^^^
[  258s] SyntaxError: invalid syntax

see full build log at
https://build.opensuse.org/package/live_build_log/devel:tools:ide:vscode/co=
de/openSUSE_Tumbleweed/x86_64

This is a regression from nodejs 21.1.0.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17007189091.E9eDcb1.12790
Date: Thu, 23 Nov 2023 05:55:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217424

          Summary
          node-gyp 21 errors out with SyntaxError

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          brunopitrus@hotmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

After Tumbleweed upgraded to node 21.2.0, the vscode RPM sta=
rted failing to
build with the following error:

[  258s] Traceback (most recent call last):
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/gyp_main.py&q=
uot;, line 45,
in <module>
[  258s]     sys.exit(gyp.script_main())
[  258s]              ^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__i=
nit__.py",
line 688, in script_main
[  258s]     return main(sys.argv[1:])
[  258s]            ^^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__i=
nit__.py",
line 680, in main
[  258s]     return gyp_main(args)
[  258s]            ^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__i=
nit__.py",
line 647, in gyp_main
[  258s]     [generator, flat_list, targets, data] =3D Load(
[  258s]                                             ^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/__i=
nit__.py",
line 157, in Load
[  258s]     result =3D gyp.input.Load(
[  258s]              ^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/inp=
ut.py",
line 2987, in Load
[  258s]     LoadTargetBuildFile(
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/inp=
ut.py",
line 400, in LoadTargetBuildFile
[  258s]     build_file_data =3D LoadOneBuildFile(
[  258s]                       ^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/pylib/gyp/inp=
ut.py",
line 237, in LoadOneBuildFile
[  258s]     build_file_data =3D eval(build_file_contents, {"__builtin=
s__": {}},
None)
[  258s]=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[  258s]   File
"/usr/lib64/node_modules/npm21/node_modules/node-gyp/gyp/gyp_main.py&q=
uot;, line 7
[  258s]     import os
[  258s]     ^^^^^^
[  258s] SyntaxError: invalid syntax

see full build log at
https://build.opensuse.org/packag=
e/live_build_log/devel:tools:ide:vscode/code/openSUSE_Tumbleweed/x86_64

This is a regression from nodejs 21.1.0.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17007189091.E9eDcb1.12790--

summary: node-gyp 21 errors out with SyntaxError


body:
Build Identifier:=20

After installing, I noticed a lack of font support for a lot of Indic and s=
outh
Asian languages.

They are both pretty populous areas so it seems like an oversight to not
include their basic fonts in the default installation.

Reproducible: Always

Steps to Reproduce:
1. Open Firefox from Flatpak (as installed by default).
2. Go to https://meta.wikimedia.org/wiki/List_of_Wikipedias
3. Look at the "Other languages" box at the top of the page.
Actual Results:=20=20
I see TOFU for several languages including Kannada.

Expected Results:=20=20
I expected to see all languages in that box be rendered by default.

I did a bit of research, and we are talking about at least these ones, list=
ed
in order of native speakers counted in millions (based on quick Wikipedia
data):

| Language   |   Native Speakers |    L2 Speakers |
| --------

summary: Missing fonts for Indic and south Asian languages.


--17010979432.52987d2F7.17895
Date: Mon, 27 Nov 2023 15:12:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217530

            Bug ID: 1217530
           Summary: [SELinux] support /bin/alts in the policy
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

a lot of binaries symlink to /bin/alts, which is an alternative to
update-alternatives, see:
https://github.com/openSUSE/libalternatives
https://manpages.opensuse.org/Tumbleweed/alts/alts.1.en.html

this causes issues like e.g. bsc#1216903 because:
```
$ ls -Zal /usr/sbin/iptables
lrwxrwxrwx. 1 root root system_u:object_r:bin_t:s0 11 Oct 24 20:13
/usr/sbin/iptables -> ../bin/alts*
```

/sbin/iptables should be labeled iptables_exec_t to work properly, but
/bin/alts should not

so we need to adjust the policy to support that
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17010979432.52987d2F7.17895
Date: Mon, 27 Nov 2023 15:12:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217530

          Summary
          [SELinux] support /bin/alts in the policy

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

a lot of binaries symlink to /bin/alts, which is an alternat=
ive to
update-alternatives, see:
https://github.com/=
openSUSE/libalternatives
ht=
tps://manpages.opensuse.org/Tumbleweed/alts/alts.1.en.html

this causes issues like e.g. bsc#1216903 because:
```
$ ls -Zal /usr/sbin/iptables
lrwxrwxrwx. 1 root root system_u:object_r:bin_t:s0 11 Oct 24 20:13
/usr/sbin/iptables -> ../bin/alts*
```

/sbin/iptables should be labeled iptables_exec_t to work properly, but
/bin/alts should not

so we need to adjust the policy to support that

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17010979432.52987d2F7.17895--


body:
--17010783872.8a58b47.17086
Date: Mon, 27 Nov 2023 09:46:27 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217520

            Bug ID: 1217520
           Summary: qemu: add support for canokeys
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: kvm-bugs-at-suse.de
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fvogt-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Looks like there's software FIDO2 support in qemu:
https://www.qemu.org/docs/master/system/devices/canokey.html

It needs https://github.com/canokeys/canokey-qemu.

Could we have that in Factory please? As we are adding FIDO2 integration wi=
th
disk encryption this would help both developing as well as later testing in
openQA.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17010783872.8a58b47.17086
Date: Mon, 27 Nov 2023 09:46:27 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217520

          Summary
          qemu: add support for canokeys

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Tools

          Assignee
          kvm-bugs@suse.de

          Reporter
          lnussel@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          fvogt@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Looks like there's software FIDO2 support in qemu:
ht=
tps://www.qemu.org/docs/master/system/devices/canokey.html

It needs https://githu=
b.com/canokeys/canokey-qemu.

Could we have that in Factory please? As we are adding FIDO2 integration wi=
th
disk encryption this would help both developing as well as later testing in
openQA.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17010783872.8a58b47.17086--

summary: qemu: add support for canokeys


body:
--170120378612.e2DEaB0FB.21026
Date: Tue, 28 Nov 2023 20:36:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217614

            Bug ID: 1217614
           Summary: VUL-0: CVE-2023-6350: libavif,chromium,ungoogled-chromium: Out of bounds memory to alphaItemIndices
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: asn-at-cryptomilk.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org, m.szczepaniak.000-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

An out of bounds memory access was reported in libavif (and bundled in
Chromium). CVE-2023-6350 was assigned to this issue.

Apparently:
https://github.com/AOMediaCodec/libavif/commit/95e5ce8ae7a9bfa5ee6537a2e825=
3b7e2155a7cc

SUSE:SLE-15-SP4:Update/libavif has 0.9.3
Chromium builds with the bundled libavif and needs a fix.

References:
https://github.com/AOMediaCodec/libavif/pull/1764
https://crbug.com/1501766
https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-des=
ktop_28.html
https://github.com/AOMediaCodec/libavif/releases/tag/v1.0.2
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--170120378612.e2DEaB0FB.21026
Date: Tue, 28 Nov 2023 20:36:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217614

          Summary
          VUL-0: CVE-2023-6350: libavif,chromium,ungoogled-chromium: Ou=
t of bounds memory to alphaItemIndices

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          asn@cryptomilk.org

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org, m.szczepaniak.000@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

An out of bounds memory access was reported in libavif (and =
bundled in
Chromium). CVE-2023-6350 was assigned to this issue.

Apparently:
https://github.com/AOMediaCodec/libavif/commit/95e=
5ce8ae7a9bfa5ee6537a2e8253b7e2155a7cc

SUSE:SLE-15-SP4:Update/libavif has 0.9.3
Chromium builds with the bundled libavif and needs a fix.

References:
https://githu=
b.com/AOMediaCodec/libavif/pull/1764
https://crbug.com/1501766
https://chromereleases.googleblog.com/2023/11/stab=
le-channel-update-for-desktop_28.html
htt=
ps://github.com/AOMediaCodec/libavif/releases/tag/v1.0.2

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--170120378612.e2DEaB0FB.21026--

pkgs: chromium ungoogled-chromium


body:
--170120378610.BfbCce4.21026
Date: Tue, 28 Nov 2023 20:36:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217615

            Bug ID: 1217615
           Summary: VUL-0: libavif,chromium,ungoogled-chromium: use-after-free in colorProperties
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: asn-at-cryptomilk.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org, m.szczepaniak.000-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A use-after free issue was reported in libavif (bundled in Chromium).
CVE-2023-6351 was assigned to this issue.

Apparent fix:
https://github.com/AOMediaCodec/libavif/commit/456f78a3b2d3eacb8ca4193b7912=
9b23785e41e9

SUSE:SLE-15-SP4:Update/libavif has 0.9.3
Chromium builds with the bundled libavif and needs a fix.

References:
https://crbug.com/1501770
https://github.com/AOMediaCodec/libavif/pull/1757
https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-des=
ktop_28.html
https://github.com/AOMediaCodec/libavif/releases/tag/v1.0.2
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--170120378610.BfbCce4.21026
Date: Tue, 28 Nov 2023 20:36:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217615

          Summary
          VUL-0: libavif,chromium,ungoogled-chromium: use-after-free in=
 colorProperties

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          asn@cryptomilk.org

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org, m.szczepaniak.000@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A use-after free issue was reported in libavif (bundled in C=
hromium).
CVE-2023-6351 was assigned to this issue.

Apparent fix:
https://github.com/AOMediaCodec/libavif/commit/456=
f78a3b2d3eacb8ca4193b79129b23785e41e9

SUSE:SLE-15-SP4:Update/libavif has 0.9.3
Chromium builds with the bundled libavif and needs a fix.

References:
https://crbug.com/1501770
https://githu=
b.com/AOMediaCodec/libavif/pull/1757
https://chromereleases.googleblog.com/2023/11/stab=
le-channel-update-for-desktop_28.html
htt=
ps://github.com/AOMediaCodec/libavif/releases/tag/v1.0.2

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--170120378610.BfbCce4.21026--


body:
--17012038924.7F071C3a8.21029
Date: Tue, 28 Nov 2023 20:38:12 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217616

            Bug ID: 1217616
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 119.0.6045.199
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org, m.szczepaniak.000-at-gmail.com
        Depends on: 1217614, 1217615
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-des=
ktop_28.html

* CVE-2023-6348: Type Confusion in Spellcheck
* CVE-2023-6347: Use after free in Mojo
* CVE-2023-6346: Use after free in WebAudio
* CVE-2023-6350: Out of bounds memory access in libavif
  filed as bug 1217614 since this affects the system libavif
* CVE-2023-6351: Use after free in libavif
  filed as bug 1217615 since this affects the system libavif
* CVE-2023-6345: Integer overflow in Skia
* Various fixes from internal audits, fuzzing and other initiatives

> Google is aware that an exploit for CVE-2023-6345 exists in the wild.

This is https://crbug.com/1505053=20
Rolled via:
https://chromium.googlesource.com/chromium/src/+/baf84c2d246a45577b7ddd2b8d=
8d2e2cf36e12e2

Two commits:
https://skia.googlesource.com/skia.git/+/afefbf7cb3f3bf406aaa62dce04e8cac50=
6cd8d8%5E%21/
https://skia.googlesource.com/skia.git/+/89907a0ce7c0c883898b8c88b55b7b7f73=
3f7058%5E%21/
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17012038924.7F071C3a8.21029
Date: Tue, 28 Nov 2023 20:38:12 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217616

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 119.0.6045.199

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          gmbr3@opensuse.org

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org, m.szczepaniak.000@gmail.com

          Depends on
          1217614, 1217615

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2023/11/stable-channel-update-for-desktop_28.html

* CVE-2023-6348: Type Confusion in Spellcheck
* CVE-2023-6347: Use after free in Mojo
* CVE-2023-6346: Use after free in WebAudio
* CVE-2023-6350: Out of bounds memory access in libavif
  filed as bug 1217614 since this affects th=
e system libavif
* CVE-2023-6351: Use after free in libavif
  filed as bug 1217615 since this affects th=
e system libavif
* CVE-2023-6345: Integer overflow in Skia
* Various fixes from internal audits, fuzzing and other initiatives

> Google is aware that an exploit for CVE-2023-634=
5 exists in the wild.

This is https://crbug.com/1505053=
=20
Rolled via:
https://chromium.googlesource.com/chromium/src/+=
/baf84c2d246a45577b7ddd2b8d8d2e2cf36e12e2

Two commits:
https://skia.googlesource.com/skia.git/+/afefbf7c=
b3f3bf406aaa62dce04e8cac506cd8d8%5E%21/
https://skia.googlesource.com/skia.git/+/89907a0c=
e7c0c883898b8c88b55b7b7f733f7058%5E%21/

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17012038924.7F071C3a8.21029--


--17012733852.8E2257.22798
Date: Wed, 29 Nov 2023 15:56:25 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217667

            Bug ID: 1217667
           Summary: gcc ICE: mariadb 11.x fails to build on i586 (builds on x86_64_
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Thia was identified while trying to update mariadb to version 11.x for
Tumbleweed.

It fails with an ICE:
[ 2110s] /home/abuild/rpmbuild/BUILD/mariadb-11.1.2/sql/item.cc: In member
function '__ct_base ':
[ 2110s] /home/abuild/rpmbuild/BUILD/mariadb-11.1.2/sql/item.cc:3105:1:
internal compiler error: in find_oldest_value_reg, at regcprop.cc:460
[ 2110s]  3105 | }
[ 2110s]       | ^
[ 2110s] 0x8ee8def internal_error(char const*, ...)
[ 2110s]        ???:0
[ 2110s] 0x8ee8ed9 fancy_abort(char const*, int, char const*)
[ 2110s]        ???:0
[ 2110s] 0x947b56a
copyprop_hardreg_forward_bb_without_debug_insn(basic_block_def*)
[ 2110s]        ???:0
[ 2110s] 0x90d44dc try_shrink_wrapping(edge_def**, rtx_insn*)
[ 2110s]        ???:0
[ 2110s] 0x8ff6d27 thread_prologue_and_epilogue_insns()
[ 2110s]        ???:0
[ 2110s] Please submit a full bug report, with preprocessed source (by using
-freport-bug).
[ 2110s] Please include the complete backtrace with any bug report.
[ 2110s] See <https://bugs.opensuse.org/> for instructions.

Full log available at
https://build.opensuse.org/build/server:database/openSUSE_Tumbleweed/i586/m=
ariadb/_log

Filip already helped identify this as being fixed in gcc/trunk, based on th=
is
upstream bug report:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D111497

Any chance to get this backported into the openSUSE Tumbleweed gcc package =
to
unblock mariadb updates?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17012733852.8E2257.22798
Date: Wed, 29 Nov 2023 15:56:25 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217667

          Summary
          gcc ICE: mariadb 11.x fails to build on i586 (builds on x86_6=
4_

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Thia was identified while trying to update mariadb to versio=
n 11.x for
Tumbleweed.

It fails with an ICE:
[ 2110s] /home/abuild/rpmbuild/BUILD/mariadb-11.1.2/sql/item.cc: In member
function '__ct_base ':
[ 2110s] /home/abuild/rpmbuild/BUILD/mariadb-11.1.2/sql/item.cc:3105:1:
internal compiler error: in find_oldest_value_reg, at regcprop.cc:460
[ 2110s]  3105 | }
[ 2110s]       | ^
[ 2110s] 0x8ee8def internal_error(char const*, ...)
[ 2110s]        ???:0
[ 2110s] 0x8ee8ed9 fancy_abort(char const*, int, char const*)
[ 2110s]        ???:0
[ 2110s] 0x947b56a
copyprop_hardreg_forward_bb_without_debug_insn(basic_block_def*)
[ 2110s]        ???:0
[ 2110s] 0x90d44dc try_shrink_wrapping(edge_def**, rtx_insn*)
[ 2110s]        ???:0
[ 2110s] 0x8ff6d27 thread_prologue_and_epilogue_insns()
[ 2110s]        ???:0
[ 2110s] Please submit a full bug report, with preprocessed source (by using
-freport-bug).
[ 2110s] Please include the complete backtrace with any bug report.
[ 2110s] See <https://bugs.opensu=
se.org/> for instructions.

Full log available at
https://build.opensuse.org/build/server:database/op=
enSUSE_Tumbleweed/i586/mariadb/_log

Filip already helped identify this as being fixed in gcc/trunk, based on th=
is
upstream bug report:
https://g=
cc.gnu.org/bugzilla/show_bug.cgi?id=3D111497

Any chance to get this backported into the openSUSE Tumbleweed gcc package =
to
unblock mariadb updates?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17012733852.8E2257.22798--


--17013403517.3dfbE.926
Date: Thu, 30 Nov 2023 10:32:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217690

            Bug ID: 1217690
           Summary: libcamera: reproducible builds vs signatures
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: rfrohl-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: jengelh-at-inai.de
            Blocks: 1062303
  Target Milestone: ---
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE+ALP, I found that
our libcamera package varies in every build
because during build it creates a random keypair,
embeds the pubkey
adds .so.sign files

When I asked upstream about it long ago, it was said to prevent smuggling i=
n of
3rd party modules that shall not receive the same level of permissions
as modules that are shipped as part of the main codebase.

Can we patch src/libcamera/ipa_module.cpp to not use .sign files
or is there another way to get reproducible build results for libcamera?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17013403517.3dfbE.926
Date: Thu, 30 Nov 2023 10:32:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217690

          Summary
          libcamera: reproducible builds vs signatures

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          All

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          rfrohl@suse.com

          Reporter
          bwiedemann@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          jengelh@inai.de

          Blocks
          1062303

          Target Milestone
          ---

          Found By
          Development

          Blocker
          ---

While working on reproducible builds for openSUSE+ALP, I fou=
nd that
our libcamera package varies in every build
because during build it creates a random keypair,
embeds the pubkey
adds .so.sign files

When I asked upstream about it long ago, it was said to prevent smuggling i=
n of
3rd party modules that shall not receive the same level of permissions
as modules that are shipped as part of the main codebase.

Can we patch src/libcamera/ipa_module.cpp to not use .sign files
or is there another way to get reproducible build results for libcamera?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17013403517.3dfbE.926--


--17013615510.EEF93fF.1717
Date: Thu, 30 Nov 2023 16:25:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217706

            Bug ID: 1217706
           Summary: AUDIT-0: plasma-branding-Kalpa: Review of sudoers file 50-kalpa
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: sfalken@cloverleaf-linux.org
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

For my package found in OBS in devel:microos:kalpa:plasma-branding-Kalpa I
would like a whitelisting for the following rpmlint error:

[   14s] plasma-branding-Kalpa.noarch: E: sudoers-file-unauthorized (Badnes=
s:
10) /etc/sudoers.d/50-kalpa (sha256 file digest default
filter:554ad7ffea09c0c9bed71f6ef7621e729d9d5368175b6e3b0e29214531d14c39 she=
ll
filter:554ad7ffea09c0c9bed71f6ef7621e729d9d5368175b6e3b0e29214531d14c39 xml
filter:<failed-to-calculate>)
[   14s] Packaging sudoers.d drop-in configuration files requires a review =
and
[   14s] whitelisting by the SUSE security team. If the package is intended=
 for
[   14s] inclusion in any SUSE product please open a bug report to request
review of
[   14s] the package by the security team. Please refer to
[   14s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   14s] more information.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17013615510.EEF93fF.1717
Date: Thu, 30 Nov 2023 16:25:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217706

          Summary
          AUDIT-0: plasma-branding-Kalpa: Review of sudoers file 50-kal=
pa

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          sfalken@cloverleaf-linux.org

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

For my package found in OBS in devel:microos:kalpa:plasma-br=
anding-Kalpa I
would like a whitelisting for the following rpmlint error:

[   14s] plasma-branding-Kalpa.noarch: E: sudoers-file-unauthorized (Badnes=
s:
10) /etc/sudoers.d/50-kalpa (sha256 file digest default
filter:554ad7ffea09c0c9bed71f6ef7621e729d9d5368175b6e3b0e29214531d14c39 she=
ll
filter:554ad7ffea09c0c9bed71f6ef7621e729d9d5368175b6e3b0e29214531d14c39 xml
filter:<failed-to-calculate>)
[   14s] Packaging sudoers.d drop-in configuration files requires a review =
and
[   14s] whitelisting by the SUSE security team. If the package is intended=
 for
[   14s] inclusion in any SUSE product please open a bug report to request
review of
[   14s] the package by the security team. Please refer to
[   14s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
[   14s] more information.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17013615510.EEF93fF.1717--


--17013616762.B2a5e841C.1720
Date: Thu, 30 Nov 2023 16:27:56 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217707

            Bug ID: 1217707
           Summary: AUDIT-0: plasma-branding-Kalpa: Review of polkit file 49-Kalpa.rules
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: sfalken@cloverleaf-linux.org
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

For my package found in OBS in devel:microos:kalpa:plasma-branding-Kalpa I
would like a whitelisting for the following rpmlint error:

[   14s] plasma-branding-Kalpa.noarch: E: polkit-file-unauthorized (Badness:
10) /usr/share/polkit-1/rules.d/49-kalpa.rules (sha256 file digest default
filter:b07feaf4e306853ec6441a45ed2e2e7da14de00edac6d86bfc96835c76dae9a2 she=
ll
filter:b07feaf4e306853ec6441a45ed2e2e7da14de00edac6d86bfc96835c76dae9a2 xml
filter:<failed-to-calculate>)
[   14s] Packaging polkit rules requires a review and whitelisting by the S=
USE
security
[   14s] team. If the package is intended for inclusion in any SUSE product
please open
[   14s] a bug report to request review of the package by the security team.
Please
[   14s] refer to
[   14s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   14s] more information.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17013616762.B2a5e841C.1720
Date: Thu, 30 Nov 2023 16:27:56 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217707

          Summary
          AUDIT-0: plasma-branding-Kalpa: Review of polkit file 49-Kalp=
a.rules

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          sfalken@cloverleaf-linux.org

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

For my package found in OBS in devel:microos:kalpa:plasma-br=
anding-Kalpa I
would like a whitelisting for the following rpmlint error:

[   14s] plasma-branding-Kalpa.noarch: E: polkit-file-unauthorized (Badness:
10) /usr/share/polkit-1/rules.d/49-kalpa.rules (sha256 file digest default
filter:b07feaf4e306853ec6441a45ed2e2e7da14de00edac6d86bfc96835c76dae9a2 she=
ll
filter:b07feaf4e306853ec6441a45ed2e2e7da14de00edac6d86bfc96835c76dae9a2 xml
filter:<failed-to-calculate>)
[   14s] Packaging polkit rules requires a review and whitelisting by the S=
USE
security
[   14s] team. If the package is intended for inclusion in any SUSE product
please open
[   14s] a bug report to request review of the package by the security team.
Please
[   14s] refer to
[   14s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
[   14s] more information.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17013616762.B2a5e841C.1720--


--17013703542.cf5ca.1834
Date: Thu, 30 Nov 2023 18:52:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217711

            Bug ID: 1217711
           Summary: [Slurm, slurmrestd] service file missing for slurmrestd
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The service file to start slurmrestd is missing from package slurm-rest.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17013703542.cf5ca.1834
Date: Thu, 30 Nov 2023 18:52:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217711

          Summary
          [Slurm, slurmrestd] service file missing for slurmrestd

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          eich@suse.com

          Reporter
          eich@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The service file to start slurmrestd is missing from package=
 slurm-rest.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17013703542.cf5ca.1834--


--17016957891.C0dA1Aee.5098
Date: Mon, 4 Dec 2023 13:16:29 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217774

            Bug ID: 1217774
           Summary: qt6-webengine qtpdf.index reproducible builds
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
our qt6-webengine / qt6-webengine-docs-html subpackage

varied between builds in /usr/share/doc/qt6/qtpdf/qtpdf.index
See diff at
https://rb.zq1.de/compare.factory-20230830/diffs/qt6-webengine-compare.out

You probably need to build with
osc build -M docs
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17016957891.C0dA1Aee.5098
Date: Mon, 4 Dec 2023 13:16:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217774

          Summary
          qt6-webengine qtpdf.index reproducible builds

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          All

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          bwiedemann@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          Development

          Blocker
          ---

While working on reproducible builds for openSUSE, I found t=
hat
our qt6-webengine / qt6-webengine-docs-html subpackage

varied between builds in /usr/share/doc/qt6/qtpdf/qtpdf.index
See diff at
https://rb.zq1.de/compare.factory-20230830/diffs/qt6-webengine-=
compare.out

You probably need to build with
osc build -M docs

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17016957891.C0dA1Aee.5098--


--17017815641.96f5AD.6822
Date: Tue, 5 Dec 2023 13:06:04 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217820

            Bug ID: 1217820
           Summary: spdlog on aarch64 and armv{6,7} needs rebuilt against libfmt10
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: brunopitrus-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Right now spdlog-devel is broken on the ARM ports as it pulls in fmt 10 hea=
ders
while the library itself exports fmt 9 types. (I do not have an arm machine=
 and
only noticed this because vscode fails to build)

What's worse, spdlog exports fmt types as part of its ABI which in particul=
ar
means that it breaks abi without soname bump whenever fmt breaks abi. This
would be less of a problem if fmt-9 were simply dropped from the distro (du=
e to
broken deps triggering a rebuild), but as it still exists, every spdlog
consumer must also be manually rebuilt.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17017815641.96f5AD.6822
Date: Tue, 5 Dec 2023 13:06:04 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217820

          Summary
          spdlog on aarch64 and armv{6,7} needs rebuilt against libfmt10

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          aarch64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          brunopitrus@hotmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Right now spdlog-devel is broken on the ARM ports as it pull=
s in fmt 10 headers
while the library itself exports fmt 9 types. (I do not have an arm machine=
 and
only noticed this because vscode fails to build)

What's worse, spdlog exports fmt types as part of its ABI which in particul=
ar
means that it breaks abi without soname bump whenever fmt breaks abi. This
would be less of a problem if fmt-9 were simply dropped from the distro (du=
e to
broken deps triggering a rebuild), but as it still exists, every spdlog
consumer must also be manually rebuilt.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17017815641.96f5AD.6822--


--17017883180.d6fF4aF8.7374
Date: Tue, 5 Dec 2023 14:58:38 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217824

            Bug ID: 1217824
           Summary: longterm kernel: figure out how to build KMPs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rfrohl-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: tiwai-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

One of the major open questions, before introducing the longterm kernel to
Factory, is how KPMs can be build.

This issue is supposed to server as a reminder, that this likely blocks the
addition to Factory until it is resolved.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17017883180.d6fF4aF8.7374
Date: Tue, 5 Dec 2023 14:58:38 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217824

          Summary
          longterm kernel: figure out how to build KMPs

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rfrohl@suse.com

          Reporter
          rfrohl@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          tiwai@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

One of the major open questions, before introducing the long=
term kernel to
Factory, is how KPMs can be build.

This issue is supposed to server as a reminder, that this likely blocks the
addition to Factory until it is resolved.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17017883180.d6fF4aF8.7374--


body:
--17018493572.5eBd3dee2.593
Date: Wed, 6 Dec 2023 07:55:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217839

            Bug ID: 1217839
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 120.0.6099.62
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: m.szczepaniak.000-at-gmail.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-des=
ktop.html

Chrome 120.0.6099.62 (Linux and Mac), 120.0.6099.62/.63( Windows) contains a
number of fixes and improvements


--17018679633.2DdF1F.1373
Date: Wed, 6 Dec 2023 13:06:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217852

            Bug ID: 1217852
           Summary: The systemd/systemd-mini packages do not provide group(systemd-journal)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: fbui-at-suse.com
          Reporter: mls-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The upcoming rpm-4.19 automatically adds user/group requires for non-root o=
wned
files.

The systemd and systemd-mini package contain a /var/log/journal directory t=
hat
has group "systemd-journal". They also contain a
/usr/lib/sysusers.d/systemd-journal.conf file that contains the group
definition.

We automatically create the user/group provides from the sysusers specifica=
tion
if the sysuser-tools is installed at build time. But this is not the case f=
or
systemd.

So, could you either add a "BuildRequires:  sysuser-tools" or add a "Provid=
es:
group(systemd-journal)" to the systemd and systemd-mini packages.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17018679633.2DdF1F.1373
Date: Wed, 6 Dec 2023 13:06:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217852

          Summary
          The systemd/systemd-mini packages do not provide group(system=
d-journal)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          fbui@suse.com

          Reporter
          mls@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The upcoming rpm-4.19 automatically adds user/group requires=
 for non-root owned
files.

The systemd and systemd-mini package contain a /var/log/journal directory t=
hat
has group "systemd-journal". They also contain a
/usr/lib/sysusers.d/systemd-journal.conf file that contains the group
definition.

We automatically create the user/group provides from the sysusers specifica=
tion
if the sysuser-tools is installed at build time. But this is not the case f=
or
systemd.

So, could you either add a "BuildRequires:  sysuser-tools" or add=
 a "Provides:
group(systemd-journal)" to the systemd and systemd-mini packages.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17018679633.2DdF1F.1373--


body:
--17019009923.4bcDfaAe3.2234
Date: Wed, 6 Dec 2023 22:16:32 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217863

            Bug ID: 1217863
           Summary: polkit 123 needs '/usr/bin/dbus-daemon'
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: tobias.klausmann-at-freenet.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

As of the new polkit commited to Tumbleweed/Factory (as of 20231206), polkit
explicitly "Requires: /usr/bin/dbus-daemon" [1] insted of the previous dbus=
-1.
With this other dbus implementations, such as dbus-broker are left out,
breaking systems with such dbus implementations:
"Problem: das zu installierende polkit-123-1.1.x86_64 erfordert
'/usr/bin/dbus-daemon', aber diese Anforderung kann nicht bereitgestellt
werden".
For an intermediate solution, the Requires could be changed back as the
changelog only states: "Add /usr/bin/dbus-daemon BuildRequires, needed for
tests. Replace the dbus-1 with /usr/bin/dbus-daemon Requires." So the expli=
cit
requirement should only be added at build time.

[1]:
https://build.opensuse.org/package/rdiff/Base:System/polkit?linkrev=3Dbase&=
rev=3D187
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17019009923.4bcDfaAe3.2234
Date: Wed, 6 Dec 2023 22:16:32 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217863

          Summary
          polkit 123 needs '/usr/bin/dbus-daemon'

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          tobias.klausmann@freenet.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

As of the new polkit commited to Tumbleweed/Factory (as of 2=
0231206), polkit
explicitly "Requires: /usr/bin/dbus-daemon" [1] insted of the pre=
vious dbus-1.
With this other dbus implementations, such as dbus-broker are left out,
breaking systems with such dbus implementations:
"Problem: das zu installierende polkit-123-1.1.x86_64 erfordert
'/usr/bin/dbus-daemon', aber diese Anforderung kann nicht bereitgestellt
werden".
For an intermediate solution, the Requires could be changed back as the
changelog only states: "Add /usr/bin/dbus-daemon BuildRequires, needed=
 for
tests. Replace the dbus-1 with /usr/bin/dbus-daemon Requires." So the =
explicit
requirement should only be added at build time.

[1]:
https://build.opensuse.org/package/rdiff/Base:Sys=
tem/polkit?linkrev=3Dbase&rev=3D187

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17019009923.4bcDfaAe3.2234--

summary: polkit 123 needs '/usr/bin/dbus-daemon'


--17021322531.04f0AcB.5734
Date: Sat, 9 Dec 2023 14:30:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217915

            Bug ID: 1217915
           Summary: AUDIT-0: gamemode: new polkit actions and rule
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: marix-at-marix.org
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

For my package found in OBS in games:tools:gamemode I would like a whitelis=
ting
for the following rpmlint errors:

gamemoded.x86_64: E: polkit-untracked-privilege (Badness: 10)
com.feralinteractive.GameMode.cpu-helper (no:no:no)

gamemoded.x86_64: E: polkit-untracked-privilege (Badness: 10)
com.feralinteractive.GameMode.procsys-helper (no:no:no)

gamemoded.x86_64: E: polkit-file-unauthorized (Badness: 10)
/usr/share/polkit-1/rules.d/gamemode.rules (sha256 file digest default
filter:fe5626c22b5599331e5db91a1f983e03d763424c0fc68a0ce0729e0290d12fed she=
ll
filter:fe5626c22b5599331e5db91a1f983e03d763424c0fc68a0ce0729e0290d12fed xml
filter:<failed-to-calculate>)

The cpu-helper is required for upstream's new CPU core pinning and parking
capability.
The procsys-helper is required for upstream's new feature to allow disabling
the Linux kernel split lock mitigation.
The new rule file is introduced as any functionality requiring privileges is
now no longer available to any user with an active session but only to those
that are members of the gamemode group. This is in line with upstream that =
also
changed the default configuration here.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17021322531.04f0AcB.5734
Date: Sat, 9 Dec 2023 14:30:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217915

          Summary
          AUDIT-0: gamemode: new polkit actions and rule

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          marix@marix.org

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

For my package found in OBS in games:tools:gamemode I would =
like a whitelisting
for the following rpmlint errors:

gamemoded.x86_64: E: polkit-untracked-privilege (Badness: 10)
com.feralinteractive.GameMode.cpu-helper (no:no:no)

gamemoded.x86_64: E: polkit-untracked-privilege (Badness: 10)
com.feralinteractive.GameMode.procsys-helper (no:no:no)

gamemoded.x86_64: E: polkit-file-unauthorized (Badness: 10)
/usr/share/polkit-1/rules.d/gamemode.rules (sha256 file digest default
filter:fe5626c22b5599331e5db91a1f983e03d763424c0fc68a0ce0729e0290d12fed she=
ll
filter:fe5626c22b5599331e5db91a1f983e03d763424c0fc68a0ce0729e0290d12fed xml
filter:&lt;failed-to-calculate&gt;)

The cpu-helper is required for upstream's new CPU core pinning and parking
capability.
The procsys-helper is required for upstream's new feature to allow disabling
the Linux kernel split lock mitigation.
The new rule file is introduced as any functionality requiring privileges is
now no longer available to any user with an active session but only to those
that are members of the gamemode group. This is in line with upstream that =
also
changed the default configuration here.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17021322531.04f0AcB.5734--


body:
--17023683501.bDD6dFd97.8326
Date: Tue, 12 Dec 2023 08:05:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217973

            Bug ID: 1217973
           Summary: warewulf: non-deterministic cpio files
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: cgoll-at-suse.com
            Blocks: 1134568
  Target Milestone: ---
          Found By: ---
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
our warewulf package varies in every build.

8 cpio files in /var/lib/warewulf/initramfs/x86_64/ vary every time:
base
capabilities/provision-adhoc
capabilities/provision-files
capabilities/provision-selinux
capabilities/provision-vnfs
capabilities/setup-filesystems
capabilities/setup-ipmi
capabilities/transport-http

Here is a partial PoC patch that helped to produce bit-reproducible results:

-

summary: warewulf: non-deterministic cpio files


--17023860482.d7F3FF6e2.8941
Date: Tue, 12 Dec 2023 13:00:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217979

            Bug ID: 1217979
           Summary: package xfsprogs: error while installing libhandle1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: comes-at-naic.edu
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

During a tumbleweed installation I saw this error message in
/var/log/zypp/history:

# 2023-12-11 14:37:08 libhandle1-6.5.0-1.1.x86_64.rpm installed ok
# Additional rpm output:
# /var/tmp/rpm-tmp.ywCvQW: line 2: mkdir: command not found
# /var/tmp/rpm-tmp.ywCvQW: line 3: touch: command not found
#
2023-12-11
14:37:08|install|libhandle1|6.5.0-1.1|x86_64||openSUSE-20231210-0|b9253b557=
3636c9723bccb7083cdcf371f1d3b9adc1de9045fe144fd2b25d7a6a89df186bf4adf81590

When libhandle1 is installed it runs the post scriptlet
%{regenerate_initrd_post}
which runs the command mkdir and touch which fail if coreutils is not insta=
lled

The fix is to add:
 %package      -n %{libname}
 Summary:        XFS Filesystem-specific Shared library
 Group:          Development/Libraries/C and C++
+Requires(post): coreutils

in the spec file. I did try to submit a fix branching filesystems:xfsprogs =
but
the branched package was empty.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17023860482.d7F3FF6e2.8941
Date: Tue, 12 Dec 2023 13:00:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217979

          Summary
          package xfsprogs: error while installing libhandle1

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          comes@naic.edu

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

During a tumbleweed installation I saw this error message in
/var/log/zypp/history:

# 2023-12-11 14:37:08 libhandle1-6.5.0-1.1.x86_64.rpm installed ok
# Additional rpm output:
# /var/tmp/rpm-tmp.ywCvQW: line 2: mkdir: command not found
# /var/tmp/rpm-tmp.ywCvQW: line 3: touch: command not found
#
2023-12-11
14:37:08|install|libhandle1|6.5.0-1.1|x86_64||openSUSE-20231210-0|b9253b557=
3636c9723bccb7083cdcf371f1d3b9adc1de9045fe144fd2b25d7a6a89df186bf4adf81590

When libhandle1 is installed it runs the post scriptlet
%{regenerate_initrd_post}
which runs the command mkdir and touch which fail if coreutils is not insta=
lled

The fix is to add:
 %package      -n %{libname}
 Summary:        XFS Filesystem-specific Shared library
 Group:          Development/Libraries/C and C++
+Requires(post): coreutils

in the spec file. I did try to submit a fix branching filesystems:xfsprogs =
but
the branched package was empty.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17023860482.d7F3FF6e2.8941--


body:
--17023984951.B371.9468
Date: Tue, 12 Dec 2023 16:28:15 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1217990

            Bug ID: 1217990
           Summary: systemd: Missing /etc/sysctl.conf
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: petr.vorel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

$ ls -la /usr/lib/sysctl.d/99-sysctl.conf
lrwxrwxrwx 1 root root 24 Nov  2 15:59 /usr/lib/sysctl.d/99-sysctl.conf ->
../../../etc/sysctl.conf

=3D> there is no /etc/sysctl.conf. I'm looking into systemd.spec:

# Since v207 /etc/sysctl.conf is no longer parsed (commit 04bf3c1a60d82791),
# however backward compatibility is provided by the following symlink.
ln -s ../../../etc/sysctl.conf %{buildroot}%{_sysctldir}/99-sysctl.conf
touch %{buildroot}%{_sysconfdir}/sysctl.conf

=3D> obviously file was not packaged:

rpm -qf /usr/lib/sysctl.d/99-sysctl.conf
systemd-254.5-5.1.x86_64

The problem is, that modprobe fails on a first run:

# modprobe ipt_state; echo $?
sysctl: cannot open "/usr/lib/sysctl.d/99-sysctl.conf": No such file or
directory
modprobe: ERROR: Error running install command '/sbin/modprobe --ignore-ins=
tall
nf_conntrack  && /sbin/sysctl --quiet --pattern
'net[.]netfilter[.]nf_conntrack.*' --system' for module nf_conntrack: retco=
de
255
modprobe: ERROR: could not insert 'xt_state': Invalid argument
1

# modprobe ipt_state; echo $?
0

Also, this does not happen on other modules (I'm not sure why, but that was=
 the
reason, why this bug was not noticed):
# modprobe nf_tables; echo $?
0

NOTE: found with LTP test setsockopt08 in ltp_syscalls
https://openqa.opensuse.org/tests/3802857#step/setsockopt08/7

which is also run with -i100 (100x in ltp_cve:
https://openqa.opensuse.org/tests/3802872#step/cve-2021-22555/7
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17023984951.B371.9468
Date: Tue, 12 Dec 2023 16:28:15 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1217990

          Summary
          systemd: Missing /etc/sysctl.conf

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          petr.vorel@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

$ ls -la /usr/lib/sysctl.d/99-sysctl.conf
lrwxrwxrwx 1 root root 24 Nov  2 15:59 /usr/lib/sysctl.d/99-sysctl.conf -&g=
t;
../../../etc/sysctl.conf

=3D> there is no /etc/sysctl.conf. I'm looking into systemd.spec:

# Since v207 /etc/sysctl.conf is no longer parsed (commit 04bf3c1a60d82791),
# however backward compatibility is provided by the following symlink.
ln -s ../../../etc/sysctl.conf %{buildroot}%{_sysctldir}/99-sysctl.conf
touch %{buildroot}%{_sysconfdir}/sysctl.conf

=3D> obviously file was not packaged:

rpm -qf /usr/lib/sysctl.d/99-sysctl.conf
systemd-254.5-5.1.x86_64

The problem is, that modprobe fails on a first run:

# modprobe ipt_state; echo $?
sysctl: cannot open "/usr/lib/sysctl.d/99-sysctl.conf": No such f=
ile or
directory
modprobe: ERROR: Error running install command '/sbin/modprobe --ignore-ins=
tall
nf_conntrack  && /sbin/sysctl --quiet --pattern
'net[.]netfilter[.]nf_conntrack.*' --system' for module nf_conntrack: retco=
de
255
modprobe: ERROR: could not insert 'xt_state': Invalid argument
1

# modprobe ipt_state; echo $?
0

Also, this does not happen on other modules (I'm not sure why, but that was=
 the
reason, why this bug was not noticed):
# modprobe nf_tables; echo $?
0

NOTE: found with LTP test setsockopt08 in ltp_syscalls
h=
ttps://openqa.opensuse.org/tests/3802857#step/setsockopt08/7

which is also run with -i100 (100x in ltp_cve:
https://openqa.opensuse.org/tests/3802872#step/cve-2021-22555/7

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17023984951.B371.9468--

summary: systemd: Missing /etc/sysctl.conf


body:
--17025493372.2eBbaa9e.12665
Date: Thu, 14 Dec 2023 10:22:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218048

            Bug ID: 1218048
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 120.0.6099.109
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-des=
ktop_12.html

 The Stable channel has been updated to 120.0.6099.109 which will roll out =
over
the coming days/weeks. A full list of changes in this build is available in=
 the
log.=20

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 9 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

-CVE-2023-6702: Type Confusion in V8
-CVE-2023-6703: Use after free in Blink.
-CVE-2023-6704: Use after free in libavif.
-CVE-2023-6705: Use after free in WebRTC.
-CVE-2023-6706: Use after free in FedCM.
-CVE-2023-6707: Use after free in CSS.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17025493372.2eBbaa9e.12665
Date: Thu, 14 Dec 2023 10:22:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218048

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 120.0.6099.109

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2023/12/stable-channel-update-for-desktop_12.html

 The Stable channel has been updated to 120.0.6099.109 which will roll out =
over
the coming days/weeks. A full list of changes in this build is available in=
 the
log.=20

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 9 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

-CVE-2023-6702: Type Confusion in V8
-CVE-2023-6703: Use after free in Blink.
-CVE-2023-6704: Use after free in libavif.
-CVE-2023-6705: Use after free in WebRTC.
-CVE-2023-6706: Use after free in FedCM.
-CVE-2023-6707: Use after free in CSS.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17025493372.2eBbaa9e.12665--


--17025592855.FA29dda0.12989
Date: Thu, 14 Dec 2023 13:08:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218062

            Bug ID: 1218062
           Summary: python-pycurl:test test fail with curl 8.5.0
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Python
          Assignee: python-maintainers-at-suse.com
          Reporter: ana.guerrero-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The update of curl 8.5.0 is blocked by a failing test of python-pycurl:test:

[   35s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D short test summary info
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
[   35s] FAILED
tests/multi_callback_test.py::MultiCallbackTest::test_easy_pause_unpause
[   35s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 1 failed, 373 passed, 7 skipped,=
 45 deselected in 13.64s
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

I'm attaching the full log.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17025592855.FA29dda0.12989
Date: Thu, 14 Dec 2023 13:08:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218062

          Summary
          python-pycurl:test test fail with curl 8.5.0

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Python

          Assignee
          python-maintainers@suse.com

          Reporter
          ana.guerrero@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The update of curl 8.5.0 is blocked by a failing test of pyt=
hon-pycurl:test:

[   35s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D short test summary info
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
[   35s] FAILED
tests/multi_callback_test.py::MultiCallbackTest::test_easy_pause_unpause
[   35s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 1 failed, 373 passed, 7 skipped,=
 45 deselected in 13.64s
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

I'm attaching the full log.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17025592855.FA29dda0.12989--


--17026359473.eE6D6c.14398
Date: Fri, 15 Dec 2023 10:25:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218098

            Bug ID: 1218098
           Summary: VUL-0: CVE-2023-50472: cjson: segmentation violation in function cJSON_SetValuestring
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/388144/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mardnh-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

cJSON v1.7.16 was discovered to contain a segmentation violation via the
function cJSON_SetValuestring at cJSON.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50472
https://github.com/DaveGamble/cJSON/issues/803
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17026359473.eE6D6c.14398
Date: Fri, 15 Dec 2023 10:25:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218098

          Summary
          VUL-0: CVE-2023-50472: cjson: segmentation violation in funct=
ion cJSON_SetValuestring

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/388144/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          mardnh@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

cJSON v1.7.16 was discovered to contain a segmentation viola=
tion via the
function cJSON_SetValuestring at cJSON.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50472
https://github.c=
om/DaveGamble/cJSON/issues/803

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17026359473.eE6D6c.14398--