--17143963271.9f0A79C.10415
Date: Mon, 29 Apr 2024 13:12:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223533

            Bug ID: 1223533
           Summary: cockpit: /nonexistent/libexec/cockpit-askpass
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 874558
  --> https://bugzilla.suse.com/attachment.cgi?id=3D874558&action=3Dedit
nonexistent/libexec/cockpit-askpass

On freshly installed Leap 15.6 + cockpit

If you login to localhost:9090 as a standard user and you try to enable the
admin view by clicking on the cockpit homescreen button, then cockpit will
raise following error

Problem becoming administrator
Sudo: unable to run /nonexistent/libexec/cockpit-askpass: No such file or
directory sudo: no password was provided sudo: a password is required

lkocman@localhost:~/Workspace/obs> sudo zypper in cockpit
[sudo] password for root:=20
Refreshing service 'NVIDIA'.
Refreshing service 'openSUSE'.
Retrieving repository 'packman' metadata
...........................................................................=
..........................................................................[=
done]
Building repository 'packman' cache
...........................................................................=
...........................................................................=
....[done]
Loading repository data...
Warning: Repository 'update-non-oss (15.6)' metadata expired since 2023-09-=
21
14:47:58 CEST.

    Warning: Repository metadata expired: Check if 'autorefresh' is turned =
on
(zypper lr), otherwise
    manually refresh the repository (zypper ref). If this does not solve the
issue, it could be that
    you are using a broken mirror or the server has actually discontinued to
support the repository.

Reading installed packages...
Resolving package dependencies...

The following 2 recommended packages were automatically selected:
  cockpit-networkmanager cockpit-storaged

The following package is recommended, but will not be installed due to
conflicts or dependency issues:
  cockpit-packagekit

The following 2 packages are suggested, but will not be installed:
  cockpit-pcp cockpit-selinux

The following 8 NEW packages are going to be installed:
  cockpit cockpit-bridge cockpit-networkmanager cockpit-storaged cockpit-sy=
stem
cockpit-ws libpwquality-tools libudisks2-0_lvm2

8 new packages to install.
Overall download size: 7.1 MiB. Already cached: 0 B. After the operation,
additional 8.3 MiB will be used.
Continue? [y/n/v/...? shows all options] (y): y
Retrieving: cockpit-bridge-309-bp156.1.2.x86_64 (repo-oss (15.6))=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (1/8), 471.8 KiB=20=20=20=20
Retrieving: cockpit-bridge-309-bp156.1.2.x86_64.rpm
...........................................................................=
..................................................[done
(10.9 KiB/s)]
Retrieving: cockpit-ws-309-bp156.1.2.x86_64 (repo-oss (15.6))=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (2/8),   1.7 MiB=20=20=20=20
Retrieving: cockpit-ws-309-bp156.1.2.x86_64.rpm
...........................................................................=
.......................................................[done
(8.4 MiB/s)]
Retrieving: libpwquality-tools-1.4.5-150600.2.2.x86_64 (repo-oss (15.6))=20=
=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (3/8),  19.4 KiB=20=20=20=20
Retrieving: libpwquality-tools-1.4.5-150600.2.2.x86_64.rpm
...........................................................................=
........................................................[done]
Retrieving: libudisks2-0_lvm2-2.9.2-150400.3.3.1.x86_64 (repo-oss (15.6))=
=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (4/8),  57.0 KiB=20=20=20=20
Retrieving: libudisks2-0_lvm2-2.9.2-150400.3.3.1.x86_64.rpm
...........................................................................=
..........................................[done
(93.5 KiB/s)]
Retrieving: cockpit-system-309-bp156.1.2.noarch (repo-oss (15.6))=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (5/8),   3.2 MiB=20=20=20=20
Retrieving: cockpit-system-309-bp156.1.2.noarch.rpm
...........................................................................=
...................................................[done
(6.7 MiB/s)]
Retrieving: cockpit-storaged-309-bp156.1.2.noarch (repo-oss (15.6))=20=20=
=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (6/8), 850.0 KiB=20=20=20=20
Retrieving: cockpit-storaged-309-bp156.1.2.noarch.rpm
...........................................................................=
.................................................[done
(4.2 MiB/s)]
Retrieving: cockpit-networkmanager-309-bp156.1.2.noarch (repo-oss (15.6))=
=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (7/8), 827.8 KiB=20=20=20=20
Retrieving: cockpit-networkmanager-309-bp156.1.2.noarch.rpm
...........................................................................=
...........................................[done
(3.8 MiB/s)]
Retrieving: cockpit-309-bp156.1.2.x86_64 (repo-oss (15.6))=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (8/8),  45.5 KiB=20=20=20=20
Retrieving: cockpit-309-bp156.1.2.x86_64.rpm
...........................................................................=
......................................................................[done]

Checking for file conflicts:
...........................................................................=
...........................................................................=
...........[done]
(1/8) Installing: cockpit-bridge-309-bp156.1.2.x86_64
...........................................................................=
.............................................................[done]
(2/8) Installing: cockpit-ws-309-bp156.1.2.x86_64
...........................................................................=
.................................................................[done]
(3/8) Installing: libpwquality-tools-1.4.5-150600.2.2.x86_64
...........................................................................=
......................................................[done]
(4/8) Installing: libudisks2-0_lvm2-2.9.2-150400.3.3.1.x86_64
...........................................................................=
.....................................................[done]
(5/8) Installing: cockpit-system-309-bp156.1.2.noarch
...........................................................................=
.............................................................[done]
(6/8) Installing: cockpit-storaged-309-bp156.1.2.noarch
...........................................................................=
...........................................................[done]
(7/8) Installing: cockpit-networkmanager-309-bp156.1.2.noarch
...........................................................................=
.....................................................[done]
(8/8) Installing: cockpit-309-bp156.1.2.x86_64
...........................................................................=
....................................................................[done]
lkocman@localhost:~/Workspace/obs> sudo systemctl enable --now cockpit.sock=
et
Created symlink /etc/systemd/system/sockets.target.wants/cockpit.socket =E2=
=86=92
/usr/lib/systemd/system/cockpit.socket.
lkocman@localhost:~/Workspace/obs>
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17143963271.9f0A79C.10415
Date: Mon, 29 Apr 2024 13:12:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223533

          Summary
          cockpit: /nonexistent/libexec/cockpit-askpass

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          lubos.kocman@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created at=
tachment 874558 [details]
nonexistent/libexec/cockpit-askpass

On freshly installed Leap 15.6 + cockpit

If you login to localhost:9090 as a standard user and you try to enable the
admin view by clicking on the cockpit homescreen button, then cockpit will
raise following error

Problem becoming administrator
Sudo: unable to run /nonexistent/libexec/cockpit-askpass: No such file or
directory sudo: no password was provided sudo: a password is required

lkocman@localhost:~/Workspace/obs> sudo zypper in cockpit
[sudo] password for root:=20
Refreshing service 'NVIDIA'.
Refreshing service 'openSUSE'.
Retrieving repository 'packman' metadata
...........................................................................=
..........................................................................[=
done]
Building repository 'packman' cache
...........................................................................=
...........................................................................=
....[done]
Loading repository data...
Warning: Repository 'update-non-oss (15.6)' metadata expired since 2023-09-=
21
14:47:58 CEST.

    Warning: Repository metadata expired: Check if 'autorefresh' is turned =
on
(zypper lr), otherwise
    manually refresh the repository (zypper ref). If this does not solve the
issue, it could be that
    you are using a broken mirror or the server has actually discontinued to
support the repository.

Reading installed packages...
Resolving package dependencies...

The following 2 recommended packages were automatically selected:
  cockpit-networkmanager cockpit-storaged

The following package is recommended, but will not be installed due to
conflicts or dependency issues:
  cockpit-packagekit

The following 2 packages are suggested, but will not be installed:
  cockpit-pcp cockpit-selinux

The following 8 NEW packages are going to be installed:
  cockpit cockpit-bridge cockpit-networkmanager cockpit-storaged cockpit-sy=
stem
cockpit-ws libpwquality-tools libudisks2-0_lvm2

8 new packages to install.
Overall download size: 7.1 MiB. Already cached: 0 B. After the operation,
additional 8.3 MiB will be used.
Continue? [y/n/v/...? shows all options] (y): y
Retrieving: cockpit-bridge-309-bp156.1.2.x86_64 (repo-oss (15.6))=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (1/8), 471.8 KiB=20=20=20=20
Retrieving: cockpit-bridge-309-bp156.1.2.x86_64.rpm
...........................................................................=
..................................................[done
(10.9 KiB/s)]
Retrieving: cockpit-ws-309-bp156.1.2.x86_64 (repo-oss (15.6))=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (2/8),   1.7 MiB=20=20=20=20
Retrieving: cockpit-ws-309-bp156.1.2.x86_64.rpm
...........................................................................=
.......................................................[done
(8.4 MiB/s)]
Retrieving: libpwquality-tools-1.4.5-150600.2.2.x86_64 (repo-oss (15.6))=20=
=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (3/8),  19.4 KiB=20=20=20=20
Retrieving: libpwquality-tools-1.4.5-150600.2.2.x86_64.rpm
...........................................................................=
........................................................[done]
Retrieving: libudisks2-0_lvm2-2.9.2-150400.3.3.1.x86_64 (repo-oss (15.6))=
=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (4/8),  57.0 KiB=20=20=20=20
Retrieving: libudisks2-0_lvm2-2.9.2-150400.3.3.1.x86_64.rpm
...........................................................................=
..........................................[done
(93.5 KiB/s)]
Retrieving: cockpit-system-309-bp156.1.2.noarch (repo-oss (15.6))=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (5/8),   3.2 MiB=20=20=20=20
Retrieving: cockpit-system-309-bp156.1.2.noarch.rpm
...........................................................................=
...................................................[done
(6.7 MiB/s)]
Retrieving: cockpit-storaged-309-bp156.1.2.noarch (repo-oss (15.6))=20=20=
=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (6/8), 850.0 KiB=20=20=20=20
Retrieving: cockpit-storaged-309-bp156.1.2.noarch.rpm
...........................................................................=
.................................................[done
(4.2 MiB/s)]
Retrieving: cockpit-networkmanager-309-bp156.1.2.noarch (repo-oss (15.6))=
=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (7/8), 827.8 KiB=20=20=20=20
Retrieving: cockpit-networkmanager-309-bp156.1.2.noarch.rpm
...........................................................................=
...........................................[done
(3.8 MiB/s)]
Retrieving: cockpit-309-bp156.1.2.x86_64 (repo-oss (15.6))=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20
                (8/8),  45.5 KiB=20=20=20=20
Retrieving: cockpit-309-bp156.1.2.x86_64.rpm
...........................................................................=
......................................................................[done]

Checking for file conflicts:
...........................................................................=
...........................................................................=
...........[done]
(1/8) Installing: cockpit-bridge-309-bp156.1.2.x86_64
...........................................................................=
.............................................................[done]
(2/8) Installing: cockpit-ws-309-bp156.1.2.x86_64
...........................................................................=
.................................................................[done]
(3/8) Installing: libpwquality-tools-1.4.5-150600.2.2.x86_64
...........................................................................=
......................................................[done]
(4/8) Installing: libudisks2-0_lvm2-2.9.2-150400.3.3.1.x86_64
...........................................................................=
.....................................................[done]
(5/8) Installing: cockpit-system-309-bp156.1.2.noarch
...........................................................................=
.............................................................[done]
(6/8) Installing: cockpit-storaged-309-bp156.1.2.noarch
...........................................................................=
...........................................................[done]
(7/8) Installing: cockpit-networkmanager-309-bp156.1.2.noarch
...........................................................................=
.....................................................[done]
(8/8) Installing: cockpit-309-bp156.1.2.x86_64
...........................................................................=
....................................................................[done]
lkocman@localhost:~/Workspace/obs> sudo systemctl enable --now cockp=
it.socket
Created symlink /etc/systemd/system/sockets.target.wants/cockpit.socket =E2=
=86=92
/usr/lib/systemd/system/cockpit.socket.
lkocman@localhost:~/Workspace/obs>

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17143963271.9f0A79C.10415--


--17144741561.67CCc7a.12559
Date: Tue, 30 Apr 2024 10:49:16 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223578

            Bug ID: 1223578
           Summary: Ensure that all %ghost entries have %attr() matching the final permissions (e.g. from systemd-tmpfiles)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

just an example

```
rpm -qlv pipewire | grep /var/lib/pip
d-------


body:
Gecko/20100101
Firefox/125.0
Build Identifier:=20

Hi !

After having installed Aeon today (ISO 20240429), I saw that applications t=
hat
have been installed during installation like the terminal, the gnome settin=
gs
app, the gnome software app, nautilus or the system monitor app were not
translated in my language set during installation (french).

I saw that a bug in 2022 (1196547) reported the same behaviour.

BUT flatpaks like firefox are in French.

My locale :
locale
LANG=3Dfr_FR.UTF-8
LC_CTYPE=3D"fr_FR.UTF-8"
LC_NUMERIC=3D"fr_FR.UTF-8"
LC_TIME=3D"fr_FR.UTF-8"
LC_COLLATE=3D"fr_FR.UTF-8"
LC_MONETARY=3D"fr_FR.UTF-8"
LC_MESSAGES=3D"fr_FR.UTF-8"
LC_PAPER=3D"fr_FR.UTF-8"
LC_NAME=3D"fr_FR.UTF-8"
LC_ADDRESS=3D"fr_FR.UTF-8"
LC_TELEPHONE=3D"fr_FR.UTF-8"
LC_MEASUREMENT=3D"fr_FR.UTF-8"
LC_IDENTIFICATION=3D"fr_FR.UTF-8"
LC_ALL=3D

Reproducible: Always

Steps to Reproduce:
1. Install Aeon with french language
2. After installation, observe that applications which are not flatpaks are=
 not
translated
3.

[ MITIGATION ]
I tried to install recommended packages by typing :
sudo tukit execute zypper inr

then for my home folders :
deleting ./config/user-dirs.locale
and then :
xdg-user-dirs-update --force

Then I reboot.
And after rebooting, language is correctly set across Gnome Desktop
environment.

[ CONFIGURATION ]
# Rapport d=E2=80=99informations du syst=C3=A8me
---

## D=C3=A9tails du compte rendu
- **Date de g=C3=A9n=C3=A9ration=C2=A0:**                         2024-05-0=
1 13:15:17

## Informations li=C3=A9es au mat=C3=A9riel=C2=A0:
- **Mod=C3=A8le du mat=C3=A9riel=C2=A0:**                         ASRock X5=
70 Taichi
- **M=C3=A9moire=C2=A0:**                                    32,0=C2=A0Gio
- **Processeur=C2=A0:**                                 AMD Ryzen=E2=84=A2 =
7 5800X3D =C3=97 16
- **Carte graphique=C2=A0:**                            NVIDIA GeForce RTX=
=E2=84=A2 2080
- **Capacit=C3=A9 du disque=C2=A0:**                         8,5=C2=A0To

## Informations li=C3=A9es au logiciel=C2=A0:
- **Version du micrologiciel=C2=A0:**                   P5.01
- **Nom du syst=C3=A8me d=E2=80=99exploitation=C2=A0:**              openSU=
SE MicroOS
- **Construction du syst=C3=A8me d=E2=80=99exploitation=C2=A0:**     (null)
- **Type de syst=C3=A8me d=E2=80=99exploitation=C2=A0:**             64=C2=
=A0bits
- **Version de GNOME=C2=A0:**                           46
- **Syst=C3=A8me de fen=C3=AAtrage=C2=A0:**                       Wayland
- **Version du noyau=C2=A0:**                           Linux 6.8.7-1-defau=
lt

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17145623741.b100.14110--

summary: Language is not set in desktop environment after installation , except in Flatpaks


--17146535462.8dB6E0bd.15930
Date: Thu, 2 May 2024 12:39:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223743

            Bug ID: 1223743
           Summary: VUL-0: CVE-2023-40533: tinyproxy: uninitialized memory use could result in certain configuration in sensitive information disclosure via crafted HTTP request
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/403892/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

An uninitialized memory use vulnerability exists in Tinyproxy 1.11.1 while
parsing HTTP requests. In certain configurations, a specially crafted HTTP
request can result in disclosure of data allocated on the heap, which could
contain sensitive information. An attacker can make an unauthenticated HTTP
request to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-40533
https://www.cve.org/CVERecord?id=3DCVE-2023-40533
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1902
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17146535462.8dB6E0bd.15930
Date: Thu, 2 May 2024 12:39:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223743

          Summary
          VUL-0: CVE-2023-40533: tinyproxy: uninitialized memory use co=
uld result in certain configuration in sensitive information disclosure via=
 crafted HTTP request

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/403892/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          jengelh@inai.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

An uninitialized memory use vulnerability exists in Tinyprox=
y 1.11.1 while
parsing HTTP requests. In certain configurations, a specially crafted HTTP
request can result in disclosure of data allocated on the heap, which could
contain sensitive information. An attacker can make an unauthenticated HTTP
request to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-40533
https://www.c=
ve.org/CVERecord?id=3DCVE-2023-40533
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1902

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17146535462.8dB6E0bd.15930--


--17147298157.0eFB.17550
Date: Fri, 3 May 2024 09:50:15 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223838

            Bug ID: 1223838
           Summary: Nonfunctional brightness keys on Apple Macbook 5.1 (mcp79,nouveau)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Kernel:Drivers
          Assignee: kernel-bugs-at-suse.de
          Reporter: ilgaz-at-ilgaz.gen.tr
        QA Contact: qa-bugs-at-suse.de
                CC: kernel-bugs-at-suse.de, qa-bugs-at-suse.de, tiwai-at-suse.com,
                    variable_valuables761-at-simplelogin.com
        Depends on: 1217750, 1217716
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 874641
  --> https://bugzilla.suse.com/attachment.cgi?id=3D874641&action=3Dedit
current dmesg output

+++ This bug was initially created as a clone of Bug #1217750 +++

It seems the brightness keys (Fn+F1,Fn+F2) do not work in Tumbleweed with
current 6.8 kernel series. This should have been reported rather long time =
ago.
This has started happening in ~6.5 series

I've attached the output of "brightnessctl -l",> which only shows keyboard
(caps lock) key and several non-existent LEDs on keyboard.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17147298157.0eFB.17550
Date: Fri, 3 May 2024 09:50:15 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223838

          Summary
          Nonfunctional brightness keys on Apple Macbook 5.1 (mcp79,nou=
veau)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Minor

          Priority
          P5 - None

          Component
          Kernel:Drivers

          Assignee
          kernel-bugs@suse.de

          Reporter
          ilgaz@ilgaz.gen.tr

          QA Contact
          qa-bugs@suse.de

          CC
          kernel-bugs@suse.de, qa-bugs@suse.de, tiwai@suse.=
com, variable_valuables761@simplelogin.com

          Depends on
          1217750, 1217716

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 874641=
 [details]
current dmesg output

+++ This bug was initially created as a clone of Bug #1217750 +++

It seems the brightness keys (Fn+F1,Fn+F2) do not work in Tumbleweed with
current 6.8 kernel series. This should have been reported rather long time =
ago.
This has started happening in ~6.5 series

I've attached the output of "brightnessctl -l",> which only sh=
ows keyboard
(caps lock) key and several non-existent LEDs on keyboard.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17147298157.0eFB.17550--


body:
--17148773653.a6De60cEE.19724
Date: Sun, 5 May 2024 02:49:25 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223900

            Bug ID: 1223900
           Summary: sddm: issue with XAUTHORITY
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: gcomes.obs-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

In xfce I use redshift to adjust the monitor night color.

If I use lightdm as displaymanager, redshift works normally.
Typing the command:
  redshift -o
gives the output:
  Trying location provider `geoclue2'...
  Using provider `geoclue2'.
  Using method `randr'.
  Waiting for current location to become available...
  etc...
But if I use sddm as displaymanager, redshift doesn't work.
Typing the command:
  redshift -o
gives the output:
  Trying location provider `geoclue2'...
  Using provider `geoclue2'.
  Authorization required, but no authorization protocol specified
  Authorization required, but no authorization protocol specified
  `RANDR Query Version' returned error -1
  Initialization of randr failed.
  Trying next method...
  Authorization required, but no authorization protocol specified
  Authorization required, but no authorization protocol specified
  X request failed: XOpenDisplay
  Initialization of vidmode failed.
  Trying next method...
  No more methods to try.

The output of:
  strace redshift -o
contains:
  access("/tmp/xauth_WYBTin", R_OK)       =3D 0
  openat(AT_FDCWD, "/tmp/xauth_WYBTin", O_RDONLY) =3D -1 EACCES (Permission
denied)

The failure of redshift is due to the fact that somehow it cannot access
/tmp/xauth_WYBTin (the value of $XAUTHORITY)
However such file is readable by the user running redshift and other xprogr=
ams
work fine.

Leap 15.5 (sddm 0.19) works fine as did the previous versions.
The issue started with sddm 0.20
(https://build.opensuse.org/package/show/openSUSE:Factory/sddm?rev=3D64)
and is currently present in Leap 15.6 and tumbleweed.

I could not figure out what exactly in sddm 0.20 is causing the problem.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17148773653.a6De60cEE.19724
Date: Sun, 5 May 2024 02:49:25 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223900

          Summary
          sddm: issue with XAUTHORITY

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KDE Applications

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          gcomes.obs@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

In xfce I use redshift to adjust the monitor night color.

If I use lightdm as displaymanager, redshift works normally.
Typing the command:
  redshift -o
gives the output:
  Trying location provider `geoclue2'...
  Using provider `geoclue2'.
  Using method `randr'.
  Waiting for current location to become available...
  etc...
But if I use sddm as displaymanager, redshift doesn't work.
Typing the command:
  redshift -o
gives the output:
  Trying location provider `geoclue2'...
  Using provider `geoclue2'.
  Authorization required, but no authorization protocol specified
  Authorization required, but no authorization protocol specified
  `RANDR Query Version' returned error -1
  Initialization of randr failed.
  Trying next method...
  Authorization required, but no authorization protocol specified
  Authorization required, but no authorization protocol specified
  X request failed: XOpenDisplay
  Initialization of vidmode failed.
  Trying next method...
  No more methods to try.

The output of:
  strace redshift -o
contains:
  access("/tmp/xauth_WYBTin", R_OK)       =3D 0
  openat(AT_FDCWD, "/tmp/xauth_WYBTin", O_RDONLY) =3D -1 EACCES (=
Permission
denied)

The failure of redshift is due to the fact that somehow it cannot access
/tmp/xauth_WYBTin (the value of $XAUTHORITY)
However such file is readable by the user running redshift and other xprogr=
ams
work fine.

Leap 15.5 (sddm 0.19) works fine as did the previous versions.
The issue started with sddm 0.20
(https://build.opensuse.org/package/show/openSUSE:Factory/sddm?rev=
=3D64)
and is currently present in Leap 15.6 and tumbleweed.

I could not figure out what exactly in sddm 0.20 is causing the problem.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17148773653.a6De60cEE.19724--

summary: sddm: issue with XAUTHORITY


--17148996642.43fbF.19766
Date: Sun, 5 May 2024 09:01:04 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223903

            Bug ID: 1223903
           Summary: gdk-pixbuf-2.42.11 causes gkrellm to fail to load
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: manfred.h-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

In the TW snapshot 20240503 there is the following shown:

> =3D=3D=3D=3D gdk-pixbuf =3D=3D=3D=3D
> Version update (2.42.10 -> 2.42.11)
> Subpackages: gdk-pixbuf-lang gdk-pixbuf-query-loaders gdk-pixbuf-thumbnai=
ler libgdk_pixbuf-2_0-0 typelib-1_0-GdkPixbuf-2_0
>=20
> - Update to version 2.42.11:
>   + Disable fringe loaders by default.
>   + Introspection fixes.
>   + Updated translations.

With this update installed, gkrellm no longer starts because it makes use of
.xpm files a lot which apparently have been disabled due to this change.

Are .xpm and .xbm files fringe?

I'd appreciate if they can be added to the default loaders again.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17148996642.43fbF.19766
Date: Sun, 5 May 2024 09:01:04 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223903

          Summary
          gdk-pixbuf-2.42.11 causes gkrellm to fail to load

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          GNOME

          Assignee
          gnome-bugs@suse.de

          Reporter
          manfred.h@gmx.net

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

In the TW snapshot 20240503 there is the following shown:

> =3D=3D=3D=3D gdk-pixbuf =3D=3D=3D=3D
> Version update (2.42.10 -> 2.42.11)
> Subpackages: gdk-pixbuf-lang gdk-pixbuf-query-loaders gdk-pixbuf-thumb=
nailer libgdk_pixbuf-2_0-0 typelib-1_0-GdkPixbuf-2_0
>=20
> - Update to version 2.42.11:
>   + Disable fringe loaders by default.
>   + Introspection fixes.
>   + Updated translations.

With this update installed, gkrellm no longer starts because it makes use of
.xpm files a lot which apparently have been disabled due to this change.

Are .xpm and .xbm files fringe?

I'd appreciate if they can be added to the default loaders again.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17148996642.43fbF.19766--


--17149297852.Cf22C.19870
Date: Sun, 5 May 2024 17:23:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223909

            Bug ID: 1223909
           Summary: Package vlc fails to build with gcc 14 because of assignments from incompatible pointer types
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mjambor-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1220571
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Vlc fails when built with GCC 14 because of use incompatible pointer
types, which used to be warnings in previous versions of GCC but are
errors by default in GCC 14:=20=20

https://build.opensuse.org/package/live_build_log/home:rguenther:plgrnd/vlc=
/openSUSE_Factory/x86_64

The bug seems to have been reported upstream as
  https://code.videolan.org/videolan/vlc/-/issues/28441
and to Gentoo as https://bugs.gentoo.org/919068.  but there is also
yet unresolved) Gentoo issue https://bugs.gentoo.org/919296 so the
particular error might not be the only one.

For more information on porting to gcc 14, see
https://gcc.gnu.org/gcc-14/porting_to.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17149297852.Cf22C.19870
Date: Sun, 5 May 2024 17:23:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223909

          Summary
          Package vlc fails to build with gcc 14 because of  assignment=
s from incompatible pointer types

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          mjambor@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1220571

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Vlc fails when built with GCC 14 because of use incompatible=
 pointer
types, which used to be warnings in previous versions of GCC but are
errors by default in GCC 14:=20=20

https://build.opensuse.org/package/liv=
e_build_log/home:rguenther:plgrnd/vlc/openSUSE_Factory/x86_64

The bug seems to have been reported upstream as
  https:/=
/code.videolan.org/videolan/vlc/-/issues/28441
and to Gentoo as https://bugs.ge=
ntoo.org/919068.  but there is also
yet unresolved) Gentoo issue htt=
ps://bugs.gentoo.org/919296 so the
particular error might not be the only one.

For more information on porting to gcc 14, see
https://gcc.gnu.org/=
gcc-14/porting_to.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17149297852.Cf22C.19870--


--17149308252.F7Fb32Ca.19873
Date: Sun, 5 May 2024 17:40:25 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223910

            Bug ID: 1223910
           Summary: Package aalib does not build with gcc 14
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mjambor-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1220571
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Package aalib does not build with gcc 14 because it misses an include
(and perhaps viloates a few other C99 requirements that gcc 14 now
treats as errors instead of just warning):

https://build.opensuse.org/package/live_build_log/home:rguenther:plgrnd/aal=
ib/openSUSE_Factory/x86_64

For more information on porting to gcc 14, see:
https://gcc.gnu.org/gcc-14/porting_to.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17149308252.F7Fb32Ca.19873
Date: Sun, 5 May 2024 17:40:25 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223910

          Summary
          Package aalib does not build with gcc 14

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          mjambor@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1220571

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Package aalib does not build with gcc 14 because it misses a=
n include
(and perhaps viloates a few other C99 requirements that gcc 14 now
treats as errors instead of just warning):

https://build.opensuse.org/package/l=
ive_build_log/home:rguenther:plgrnd/aalib/openSUSE_Factory/x86_64

For more information on porting to gcc 14, see:
https://gcc.gnu.org/=
gcc-14/porting_to.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17149308252.F7Fb32Ca.19873--


--17149872613.bF689.20800
Date: Mon, 6 May 2024 09:21:01 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223925

            Bug ID: 1223925
           Summary: VUL-0: CVE-2024-34508: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/404391/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: kde-maintainers-at-suse.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: gianluca.gabrielli-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE
message.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-34508
https://www.cve.org/CVERecord?id=3DCVE-2024-34508
https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca0=
1f5
https://support.dcmtk.org/redmine/issues/1114
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17149872613.bF689.20800
Date: Mon, 6 May 2024 09:21:01 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223925

          Summary
          VUL-0: CVE-2024-34508: dcmnet in DCMTK before 3.6.9 has a seg=
mentation fault via an invalid DIMSE message.

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/404391/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          kde-maintainers@suse.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          gianluca.gabrielli@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

dcmnet in DCMTK before 3.6.9 has a segmentation fault via an=
 invalid DIMSE
message.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-34508
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-34508
https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f=
0b17a8b4ce305ca01f5
https://support.d=
cmtk.org/redmine/issues/1114

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17149872613.bF689.20800--


body:
--17152007133.d40B9.28237
Date: Wed, 8 May 2024 20:38:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224070

            Bug ID: 1224070
           Summary: Missing Ark context menu in dolphin
    Classification: openSUSE
           Product: openSUSE Kalpa
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Desktop Environment
          Assignee: sfalken@cloverleaf-linux.org
          Reporter: mh306602-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Because Dolphin is installed through rpm and ark through flatpak, the
integration is flawed between the 2.

Could be fixed by either having both be installed through rpm's or both thr=
ough
flatpak.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17152007133.d40B9.28237
Date: Wed, 8 May 2024 20:38:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224070

          Summary
          Missing Ark context menu in dolphin

          Classification
          openSUSE

          Product
          openSUSE Kalpa

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Enhancement

          Priority
          P5 - None

          Component
          Desktop Environment

          Assignee
          sfalken@cloverleaf-linux.org

          Reporter
          mh306602@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Because Dolphin is installed through rpm and ark through fla=
tpak, the
integration is flawed between the 2.

Could be fixed by either having both be installed through rpm's or both thr=
ough
flatpak.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17152007133.d40B9.28237--

summary: Missing Ark context menu in dolphin


--17153424775.Ed69.31875
Date: Fri, 10 May 2024 12:01:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224120

            Bug ID: 1224120
           Summary: [SELinux] AVC denial systemd-fstab-g on MicroOS
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: mcepl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: arvidjaar-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

mitmanek:~ # ausearch -m AVC -ts boot
----
time->Fri May 10 00:24:35 2024
type=3DAVC msg=3Daudit(1715293475.979:21): avc:  denied  { map_read map_wri=
te } for
 pid=3D1237 comm=3D"systemd-fstab-g"
scontext=3Dsystem_u:system_r:systemd_fstab_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D1
----
time->Fri May 10 00:24:35 2024
type=3DAVC msg=3Daudit(1715293475.979:22): avc:  denied  { map_read map_wri=
te } for
 pid=3D1245 comm=3D"systemd-gpt-aut"
scontext=3Dsystem_u:system_r:systemd_gpt_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D1
----
time->Fri May 10 00:34:38 2024
type=3DAVC msg=3Daudit(1715294078.083:118): avc:  denied  { unlink } for  p=
id=3D1894
comm=3D"bootctl" name=3D"bfb41e21a4f34f10958f75adb1378666-6.8.7-1-default-7=
5.conf"
dev=3D"nvme0n1p2" ino=3D43 scontext=3Dsystem_u:system_r:snapperd_t:s0
tcontext=3Dsystem_u:object_r:dosfs_t:s0 tclass=3Dfile permissive=3D1
mitmanek:~ #=20

I don=E2=80=99t see any actual negative effects.

Also mentioned on
https://lists.opensuse.org/archives/list/factory-at-lists.opensuse.org/thread/=
2KDAFQ6GBGUAPXWINMR43PVX2U2VYSFD/
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17153424775.Ed69.31875
Date: Fri, 10 May 2024 12:01:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224120

          Summary
          [SELinux] AVC denial systemd-fstab-g on MicroOS

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          mcepl@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          arvidjaar@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

mitmanek:~ # ausearch -m AVC -ts boot
----
time->Fri May 10 00:24:35 2024
type=3DAVC msg=3Daudit(1715293475.979:21): avc:  denied  { map_read map_wri=
te } for
 pid=3D1237 comm=3D"systemd-fstab-g"
scontext=3Dsystem_u:system_r:systemd_fstab_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D1
----
time->Fri May 10 00:24:35 2024
type=3DAVC msg=3Daudit(1715293475.979:22): avc:  denied  { map_read map_wri=
te } for
 pid=3D1245 comm=3D"systemd-gpt-aut"
scontext=3Dsystem_u:system_r:systemd_gpt_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D1
----
time->Fri May 10 00:34:38 2024
type=3DAVC msg=3Daudit(1715294078.083:118): avc:  denied  { unlink } for  p=
id=3D1894
comm=3D"bootctl" name=3D"bfb41e21a4f34f10958f75adb1378666-6.=
8.7-1-default-75.conf"
dev=3D"nvme0n1p2" ino=3D43 scontext=3Dsystem_u:system_r:snapperd_=
t:s0
tcontext=3Dsystem_u:object_r:dosfs_t:s0 tclass=3Dfile permissive=3D1
mitmanek:~ #=20

I don=E2=80=99t see any actual negative effects.

Also mentioned on
https://lists.opensuse.or=
g/archives/list/factory@lists.opensuse.org/thread/2KDAFQ6GBGUAPXWINMR43=
PVX2U2VYSFD/

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17153424775.Ed69.31875--


--17154979731.A40A6fAce.1515
Date: Sun, 12 May 2024 07:12:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224150

            Bug ID: 1224150
           Summary: [Build 20240511] boot_encrypt: grub does not ask for encryption key
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4179275/modules/boot
                    _encrypt/steps/2
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Bootloader
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

Grub no longer asks for the decryption key.

The snapshot contained a grub2 change:

+- Fix gcc error with CFLAGS=3D-Og
+  * grub2-grubenv-in-btrfs-header.patch
+

Which sounds harmless

there were also plymouth changes, but the failure seems too early for plymo=
uth

openQA test in scenario
opensuse-Tumbleweed-NET-x86_64-lvm-encrypt-separate-boot@64bit fails in
[boot_encrypt](https://openqa.opensuse.org/tests/4179275/modules/boot_encry=
pt/steps/2)

## Test suite description
Same as lvm-full-encrypt, but with separate boot not encrypted partition.
Maintainer: riafarov

INSTALLONLY=3D1
UNENCRYPTED_BOOT=3D1
DESKTOP=3Dgnome
ENCRYPT=3D1
FULL_LVM_ENCRYPT=3D1

## Reproducible

Fails since (at least) Build
[20240509](https://openqa.opensuse.org/tests/4172240)

## Expected result

Last good: [20240508](https://openqa.opensuse.org/tests/4169788) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DNET&machine=3D64bit&test=3Dlvm-encrypt-separate-boot&versio=
n=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17154979731.A40A6fAce.1515
Date: Sun, 12 May 2024 07:12:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224150

          Summary
          [Build 20240511] boot_encrypt: grub does not ask for encrypti=
on key

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4179275/modules/boot_encryp=
t/steps/2

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Bootloader

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

Grub no longer asks for the decryption key.

The snapshot contained a grub2 change:

+- Fix gcc error with CFLAGS=3D-Og
+  * grub2-grubenv-in-btrfs-header.patch
+

Which sounds harmless

there were also plymouth changes, but the failure seems too early for plymo=
uth

openQA test in scenario
opensuse-Tumbleweed-NET-x86_64-lvm-encrypt-separate-boot@64bit fails in
[boot_encrypt](https://openqa.opensuse.org/tests/4179275/modules/bo=
ot_encrypt/steps/2)

## Test suite description
Same as lvm-full-encrypt, but with separate boot not encrypted partition.
Maintainer: riafarov

INSTALLONLY=3D1
UNENCRYPTED_BOOT=3D1
DESKTOP=3Dgnome
ENCRYPT=3D1
FULL_LVM_ENCRYPT=3D1

## Reproducible

Fails since (at least) Build
[20240509](https://op=
enqa.opensuse.org/tests/4172240)

## Expected result

Last good: [20240508](https://openqa.opensuse.org/tests/4169788) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/=
tests/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DNET&machi=
ne=3D64bit&test=3Dlvm-encrypt-separate-boot&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17154979731.A40A6fAce.1515--


--17156814503.3F06e.4294
Date: Tue, 14 May 2024 10:10:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224208

            Bug ID: 1224208
           Summary: VUL-0: CVE-2024-4671: chromium,ungoogled-chromium: use after free in Visuals
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405002/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: carlos.lopez-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Use after free in Visuals. Google is aware that an exploit for CVE-2024-4671
exists in the wild.

Upstream bug(s):

https://issues.chromium.org/issues/339266700

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-4671
https://bugzilla.redhat.com/show_bug.cgi?id=3D2280246
https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-des=
ktop_9.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17156814503.3F06e.4294
Date: Tue, 14 May 2024 10:10:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224208

          Summary
          VUL-0: CVE-2024-4671: chromium,ungoogled-chromium: use after =
free in Visuals

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405002/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          gmbr3@opensuse.org

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          carlos.lopez@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Use after free in Visuals. Google is aware that an exploit f=
or CVE-2024-4671
exists in the wild.

Upstream bug(s):

https://issues.chr=
omium.org/issues/339266700

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-4671
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2280246
https://chromereleases.googleblog.com/2024/05/stabl=
e-channel-update-for-desktop_9.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17156814503.3F06e.4294--


--17156967472.eDCa47EFd.5368
Date: Tue, 14 May 2024 14:25:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224217

            Bug ID: 1224217
           Summary: [armv7hl] Missing debug repo for openSUSE Leap 15.X
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This is probably a very lower prio item due to armv7hl being a side effort

It seems like we have not offered debug repo from 15.3

I wrote a basic CI test for openSUSE-repos=20
https://github.com/openSUSE/openSUSE-repos/blob/main/.github/workflows/repo=
_checks.yml

and it found that source and debug repos practically do not exist
for oss/source-repo we can use the main source repo ... although there migh=
t be
some divergance

However debuginfo repo for 15.4/15.5/15.6 is missing (relevant is only
15.5/15.6)
http://cdn.opensuse.org/ports/armv7hl/debug/distribution/leap/

Once we have situation fixed (if ever) please edit to no longer treat it as=
 an
exception
https://github.com/openSUSE/openSUSE-repos/blob/main/.github/workflows/repo=
_checks.yml

I expect not to have armv7hl in Leap 16 so problem might fix itself by new =
repo
definitions for a new major release.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17156967472.eDCa47EFd.5368
Date: Tue, 14 May 2024 14:25:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224217

          Summary
          [armv7hl] Missing debug repo for openSUSE Leap 15.X

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          lubos.kocman@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This is probably a very lower prio item due to armv7hl being=
 a side effort

It seems like we have not offered debug repo from 15.3

I wrote a basic CI test for openSUSE-repos=20
https://github.com/openSUSE/openSUSE-repos/blob/mai=
n/.github/workflows/repo_checks.yml

and it found that source and debug repos practically do not exist
for oss/source-repo we can use the main source repo ... although there migh=
t be
some divergance

However debuginfo repo for 15.4/15.5/15.6 is missing (relevant is only
15.5/15.6)
=
http://cdn.opensuse.org/ports/armv7hl/debug/distribution/leap/

Once we have situation fixed (if ever) please edit to no longer treat it as=
 an
exception
https://github.com/openSUSE/openSUSE-repos/blob/mai=
n/.github/workflows/repo_checks.yml

I expect not to have armv7hl in Leap 16 so problem might fix itself by new =
repo
definitions for a new major release.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17156967472.eDCa47EFd.5368--


--17157093472.67FEdEF.5826
Date: Tue, 14 May 2024 17:55:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224229

            Bug ID: 1224229
           Summary: VUL-0: CVE-2024-25641: cacti: arbitrary file write vulnerability in the "Package Import" feature
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405057/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. Pr=
ior
to version 1.2.27, an arbitrary file write vulnerability, exploitable throu=
gh
the "Package Import" feature, allows authenticated users having the "Import
Templates" permission to execute arbitrary PHP code on the web server. The
vulnerability is located within the `import_package()` function defined into
the `/lib/import.php` script. The function blindly trusts the filename and =
file
content provided within the XML data, and writes such files into the Cacti =
base
path (or even outside, since path traversal sequences are not filtered). Th=
is
can be exploited to write or overwrite arbitrary files on the web server,
leading to execution of arbitrary PHP code or other security impacts. Versi=
on
1.2.27 contains a patch for this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-25641
https://www.cve.org/CVERecord?id=3DCVE-2024-25641
https://github.com/Cacti/cacti/commit/eff35b0ff26cc27c82d7880469ed6d5e3bef6=
210
https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157093472.67FEdEF.5826
Date: Tue, 14 May 2024 17:55:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224229

          Summary
          VUL-0: CVE-2024-25641: cacti: arbitrary file write vulnerabil=
ity in the "Package Import" feature

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405057/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. Prior
to version 1.2.27, an arbitrary file write vulnerability, exploitable throu=
gh
the "Package Import" feature, allows authenticated users having t=
he "Import
Templates" permission to execute arbitrary PHP code on the web server.=
 The
vulnerability is located within the `import_package()` function defined into
the `/lib/import.php` script. The function blindly trusts the filename and =
file
content provided within the XML data, and writes such files into the Cacti =
base
path (or even outside, since path traversal sequences are not filtered). Th=
is
can be exploited to write or overwrite arbitrary files on the web server,
leading to execution of arbitrary PHP code or other security impacts. Versi=
on
1.2.27 contains a patch for this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-25641
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-25641
https://github.com/Cacti/cacti/commit/eff35b0ff26cc27c82d78=
80469ed6d5e3bef6210
https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-p=
j88

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157093472.67FEdEF.5826--


--17157095930.B22d.5832
Date: Tue, 14 May 2024 17:59:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224230

            Bug ID: 1224230
           Summary: VUL-0: CVE-2024-27082: cacti: stored cross-site scripting vulnerability when managing trees
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405061/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework.
Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site
scripting, a type of cross-site scripting where malicious scripts are
permanently stored on a target server and served to users who access a
particular page. Version 1.2.27 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-27082
https://www.cve.org/CVERecord?id=3DCVE-2024-27082
https://github.com/Cacti/cacti/security/advisories/GHSA-j868-7vjp-rp9h
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157095930.B22d.5832
Date: Tue, 14 May 2024 17:59:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224230

          Summary
          VUL-0: CVE-2024-27082: cacti: stored cross-site scripting vul=
nerability when managing trees

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405061/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework.
Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site
scripting, a type of cross-site scripting where malicious scripts are
permanently stored on a target server and served to users who access a
particular page. Version 1.2.27 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-27082
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-27082
https://github.com/Cacti/cacti/security/advisories/GHSA-j868-7vjp-r=
p9h

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157095930.B22d.5832--


--17157098354.Bbb776.5838
Date: Tue, 14 May 2024 18:03:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224231

            Bug ID: 1224231
           Summary: VUL-0: CVE-2024-29894: cacti: residual cross-site scripting vulnerability caused by incomplete fix
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405104/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework.
Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting
vulnerability caused by an incomplete fix for CVE-2023-50250.
`raise_message_javascript` from `lib/functions.php` now uses purify.js to f=
ix
CVE-2023-50250 (among others). However, it still generates the code out of
unescaped PHP variables `$title` and `$header`. If those variables contain
single quotes, they can be used to inject JavaScript code. An attacker
exploiting this vulnerability could execute actions on behalf of other user=
s.
This ability to impersonate users could lead to unauthorized changes to
settings. Version 1.2.27 fixes this issue.

References:
https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-29894
https://www.cve.org/CVERecord?id=3DCVE-2024-29894
https://github.com/Cacti/cacti/security/advisories/GHSA-grj5-8fcj-34gh
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157098354.Bbb776.5838
Date: Tue, 14 May 2024 18:03:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224231

          Summary
          VUL-0: CVE-2024-29894: cacti: residual cross-site scripting v=
ulnerability caused by incomplete fix

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405104/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework.
Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting
vulnerability caused by an incomplete fix for CVE-2023-50250.
`raise_message_javascript` from `lib/functions.php` now uses purify.js to f=
ix
CVE-2023-50250 (among others). However, it still generates the code out of
unescaped PHP variables `$title` and `$header`. If those variables contain
single quotes, they can be used to inject JavaScript code. An attacker
exploiting this vulnerability could execute actions on behalf of other user=
s.
This ability to impersonate users could lead to unauthorized changes to
settings. Version 1.2.27 fixes this issue.

References:
https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-x=
m73
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-29894
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-29894
https://github.com/Cacti/cacti/security/advisories/GHSA-grj5-8fcj-3=
4gh

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157098354.Bbb776.5838--


--17157106041.d44bB31.5880
Date: Tue, 14 May 2024 18:16:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224235

            Bug ID: 1224235
           Summary: VUL-0: CVE-2024-31443: cacti: cross-site scripting vulnerability when managing data queries
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405127/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. Pr=
ior
to 1.2.27, some of the data stored in `form_save()` function in
`data_queries.php` is not thoroughly checked and is used to concatenate the
HTML statement in `grow_right_pane_tree()` function from `lib/html.php` ,
finally resulting in cross-site scripting. Version 1.2.27 contains a patch =
for
the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31443
https://www.cve.org/CVERecord?id=3DCVE-2024-31443
https://github.com/Cacti/cacti/commit/f946fa537d19678f938ddbd784a10e3290d27=
5cf
https://github.com/Cacti/cacti/security/advisories/GHSA-rqc8-78cm-85j3
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157106041.d44bB31.5880
Date: Tue, 14 May 2024 18:16:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224235

          Summary
          VUL-0: CVE-2024-31443: cacti: cross-site scripting vulnerabil=
ity when managing data queries

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405127/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. Prior
to 1.2.27, some of the data stored in `form_save()` function in
`data_queries.php` is not thoroughly checked and is used to concatenate the
HTML statement in `grow_right_pane_tree()` function from `lib/html.php` ,
finally resulting in cross-site scripting. Version 1.2.27 contains a patch =
for
the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31443
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-31443
https://github.com/Cacti/cacti/commit/f946fa537d19678f938dd=
bd784a10e3290d275cf
https://github.com/Cacti/cacti/security/advisories/GHSA-rqc8-78cm-8=
5j3

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157106041.d44bB31.5880--


--17157107011.17B7.5886
Date: Tue, 14 May 2024 18:18:21 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224236

            Bug ID: 1224236
           Summary: VUL-0: CVE-2024-31444: cacti: cross-site scripting vulnerability when reading tree rules with Automation API
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405128/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. Pr=
ior
to version 1.2.27, some of the data stored in
`automation_tree_rules_form_save()` function in `automation_tree_rules.php`=
 is
not thoroughly checked and is used to concatenate the HTML statement in
`form_confirm()` function from `lib/html.php` , finally resulting in cross-=
site
scripting. Version 1.2.27 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31444
https://www.cve.org/CVERecord?id=3DCVE-2024-31444
https://github.com/Cacti/cacti/security/advisories/GHSA-p4ch-7hjw-6m87
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157107011.17B7.5886
Date: Tue, 14 May 2024 18:18:21 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224236

          Summary
          VUL-0: CVE-2024-31444: cacti: cross-site scripting vulnerabil=
ity when reading tree rules with Automation API

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405128/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. Prior
to version 1.2.27, some of the data stored in
`automation_tree_rules_form_save()` function in `automation_tree_rules.php`=
 is
not thoroughly checked and is used to concatenate the HTML statement in
`form_confirm()` function from `lib/html.php` , finally resulting in cross-=
site
scripting. Version 1.2.27 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31444
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-31444
https://github.com/Cacti/cacti/security/advisories/GHSA-p4ch-7hjw-6=
m87

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157107011.17B7.5886--


--17157109480.EC0baEB.5892
Date: Tue, 14 May 2024 18:22:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224237

            Bug ID: 1224237
           Summary: VUL-0: CVE-2024-31445: cacti: SQL injection vulnerability when retrieving graphs using Automation API
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405129/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. Pr=
ior
to version 1.2.27, a SQL injection vulnerability in
`automation_get_new_graphs_sql` function of `api_automation.php` allows
authenticated users to exploit these SQL injection vulnerabilities to perfo=
rm
privilege escalation and remote code execution. In `api_automation.php` line
856, the `get_request_var('filter')` is being concatenated into the SQL
statement without any sanitization. In `api_automation.php` line 717, The
filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for
it. Version 1.2.27 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31445
https://www.cve.org/CVERecord?id=3DCVE-2024-31445
https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd1=
8/lib/api_automation.php#L717
https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd1=
8/lib/api_automation.php#L856
https://github.com/Cacti/cacti/commit/fd93c6e47651958b77c3bbe6a01fff695f81e=
886
https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6pcc
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157109480.EC0baEB.5892
Date: Tue, 14 May 2024 18:22:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1224237

          Summary
          VUL-0: CVE-2024-31445: cacti: SQL injection vulnerability whe=
n retrieving graphs using Automation API

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405129/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. Prior
to version 1.2.27, a SQL injection vulnerability in
`automation_get_new_graphs_sql` function of `api_automation.php` allows
authenticated users to exploit these SQL injection vulnerabilities to perfo=
rm
privilege escalation and remote code execution. In `api_automation.php` line
856, the `get_request_var('filter')` is being concatenated into the SQL
statement without any sanitization. In `api_automation.php` line 717, The
filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for
it. Version 1.2.27 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31445
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-31445
https://github.com/Cacti/cacti/bl=
ob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L717
https://github.com/Cacti/cacti/bl=
ob/501712998589763d411a68d35e3cda98fd9cfd18/lib/api_automation.php#L856
https://github.com/Cacti/cacti/commit/fd93c6e47651958b77c3b=
be6a01fff695f81e886
https://github.com/Cacti/cacti/security/advisories/GHSA-vjph-r677-6=
pcc

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157109480.EC0baEB.5892--


--17157110642.A25cde6.5898
Date: Tue, 14 May 2024 18:24:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1224238

            Bug ID: 1224238
           Summary: VUL-0: CVE-2024-31459: cacti: file inclusion issue in the `lib/plugin.php` file
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/405131/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. Pr=
ior
to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php`
file. Combined with SQL injection vulnerabilities, remote code execution ca=
n be
implemented. There is a file inclusion issue with the `api_plugin_hook()`
function in the `lib/plugin.php` file, which reads the plugin_hooks and
plugin_config tables in database. The read data is directly used to concate=
nate
the file path which is used for file inclusion. Version 1.2.27 contains a p=
atch
for the issue.

References:
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31459
https://www.cve.org/CVERecord?id=3DCVE-2024-31459
https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p2rv
https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-gh8r
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17157110642.A25cde6.5898
Date: Tue, 14 May 2024 18:24:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          <a class=3D"bz_bug_link=20
          bz_status_NEW "
   title=3D"NEW - VUL-0: CVE-2024-31459: cacti: file inclusion issue in the=
 `lib/plugin.php` file"
   href=3D"https://bugzilla.suse.com/show_bug.cgi?id=3D1224238">1224238

          Summary
          VUL-0: CVE-2024-31459: cacti: file inclusion issue in the `li=
b/plugin.php` file

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/405131/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. Prior
to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php`
file. Combined with SQL injection vulnerabilities, remote code execution ca=
n be
implemented. There is a file inclusion issue with the `api_plugin_hook()`
function in the `lib/plugin.php` file, which reads the plugin_hooks and
plugin_config tables in database. The read data is directly used to concate=
nate
the file path which is used for file inclusion. Version 1.2.27 contains a p=
atch
for the issue.

References:
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-8=
6vp
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31459
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-31459
https://github.com/Cacti/cacti/security/advisories/GHSA-cx8g-hvq8-p=
2rv
https://github.com/Cacti/cacti/security/advisories/GHSA-gj3f-p326-g=
h8r

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17157110642.A25cde6.5898--