body:
--17601150093.e2f2faac2.3495
Date: Fri, 10 Oct 2025 16:50:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1251868

            Bug ID: 1251868
           Summary: haproxy can start out of the box
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werwolf131313-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

now in oss haproxy build without systemd notify support:
> [werwolf@gw] ~=20=20
> =E2=9D=AF haproxy -vv                                                    =
                                                                           =
                                                                           =
                                                    =E2=8F=8E
> HAProxy version 3.2.6 2025/10/03 - https://haproxy.org/
> Status: long-term supported branch - will stop receiving fixes around Q2 =
2030.
> Known bugs: http://www.haproxy.org/bugs/bugs-3.2.6.html
> Running on: Linux 6.17.0-2-default #1 SMP PREEMPT_DYNAMIC Thu Oct  2 08:1=
2:40 UTC 2025 (190326b) x86_64
> Build options :=20
>   TARGET  =3D linux-glibc
>   CC      =3D cc
>   CFLAGS  =3D -O2 -g -fwrapv
>   OPTIONS =3D USE_GETADDRINFO=3D1 USE_OPENSSL=3D1 USE_LUA=3D1 USE_ZLIB=3D=
1 USE_TFO=3D1 USE_NS=3D1 USE_QUIC=3D1 USE_PROMEX=3D1 USE_PCRE2=3D1 USE_PCRE=
2_JIT=3D1 USE_QUIC_OPENSSL_COMPAT=3D1 USE_PIE=3D1 USE_STACKPROTECTOR=3D1 US=
E_RELRO_NOW=3D1
>   DEBUG   =3D=20
>=20
> Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU_AFFINITY +C=
RYPT_H -DEVICEATLAS +DL -ENGINE +EPOLL -EVPORTS +GETADDRINFO -KQUEUE -LIBAT=
OMIC +LIBCRYPT +LINUX_CAP +LINUX_SPLICE +LINUX_TPROXY +LUA +MATH -MEMORY_PR=
OFILING +NETFILTER +NS -OBSOLETE_LINKER +OPENSSL -OPENSSL_AWSLC -OPENSSL_WO=
LFSSL -OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT +POLL +PRCTL -PROCCTL +PROMEX -=
PTHREAD_EMULATION +QUIC +QUIC_OPENSSL_COMPAT +RT -SLZ +SSL -STATIC_PCRE -ST=
ATIC_PCRE2 +TFO +THREAD +THREAD_DUMP +TPROXY -WURFL +ZLIB +ACME
>=20
> Default settings :
>   bufsize =3D 16384, maxrewrite =3D 1024, maxpollevents =3D 200
>=20
> Built with multi-threading support (MAX_TGROUPS=3D32, MAX_THREADS=3D1024,=
 default=3D4).
> Built with SSL library version : OpenSSL 3.5.3 16 Sep 2025
> Running on SSL library version : OpenSSL 3.5.3 16 Sep 2025
> SSL library supports TLS extensions : yes
> SSL library supports SNI : yes
> SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
> OpenSSL providers loaded : default
> QUIC: connection socket-owner mode support : yes
> QUIC: GSO emission support : yes
> Built with Lua version : Lua 5.4.8
> Built with the Prometheus exporter as a service
> Built with network namespace support.
> Built with zlib version : 1.3.1
> Running on zlib version : 1.3.1
> Compression algorithms supported : identity("identity"), deflate("deflate=
"), raw-deflate("deflate"), gzip("gzip")
> Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARE=
NT IP_FREEBIND
> Built with PCRE2 version : 10.46 2025-08-27
> PCRE2 library supports JIT : yes
> Encrypted password support via crypt(3): yes
> Built with gcc compiler version 15.2.0
>=20
> Available polling systems :
>       epoll : pref=3D300,  test result OK
>        poll : pref=3D200,  test result OK
>      select : pref=3D150,  test result OK
> Total: 3 (3 usable), will use epoll.
>=20
> Available multiplexer protocols :
> (protocols marked as <default> cannot be specified using 'proto' keyword)
>        quic : mode=3DHTTP  side=3DFE     mux=3DQUIC  flags=3DHTX|NO_UPG|F=
RAMED
>          h2 : mode=3DHTTP  side=3DFE|BE  mux=3DH2    flags=3DHTX|HOL_RISK=
|NO_UPG
>   <default> : mode=3DHTTP  side=3DFE|BE  mux=3DH1    flags=3DHTX
>          h1 : mode=3DHTTP  side=3DFE|BE  mux=3DH1    flags=3DHTX|NO_UPG
>        fcgi : mode=3DHTTP  side=3DBE     mux=3DFCGI  flags=3DHTX|HOL_RISK=
|NO_UPG
>   <default> : mode=3DSPOP  side=3DBE     mux=3DSPOP  flags=3DHOL_RISK|NO_=
UPG
>        spop : mode=3DSPOP  side=3DBE     mux=3DSPOP  flags=3DHOL_RISK|NO_=
UPG
>   <default> : mode=3DTCP   side=3DFE|BE  mux=3DPASS  flags=3D
>        none : mode=3DTCP   side=3DFE|BE  mux=3DPASS  flags=3DNO_UPG
>=20
> Available services : prometheus-exporter
> Available filters :
>         [BWLIM] bwlim-in
>         [BWLIM] bwlim-out
>         [CACHE] cache
>         [COMP] compression
>         [FCGI] fcgi-app
>         [SPOE] spoe
>         [TRACE] trace

but systemd service for daemon with systemd support:
> =E2=9D=AF systemctl cat haproxy.service
> # /usr/lib/systemd/system/haproxy.service
> [Unit]
> Description=3DHAProxy Load Balancer
> After=3Dnetwork-online.target
> Wants=3Dnetwork-online.target
>=20
> [Service]
> EnvironmentFile=3D-/etc/default/haproxy
> EnvironmentFile=3D-/etc/sysconfig/haproxy
> Environment=3D"CONFIG=3D/etc/haproxy/haproxy.cfg" "PIDFILE=3D/run/haproxy=
/pid" "EXTRAOPTS=3D-S /run/haproxy/master.sock"
> ExecStart=3D/usr/sbin/haproxy -Ws -f $CONFIG -p $PIDFILE $EXTRAOPTS
> ExecReload=3D/usr/sbin/haproxy -Ws -f $CONFIG -c $EXTRAOPTS
> ExecReload=3D/bin/kill -USR2 $MAINPID
> KillMode=3Dmixed
> Restart=3Dalways
> SuccessExitStatus=3D143
> Type=3Dnotify
>=20
> # The following lines leverage SystemD's sandboxing options to provide
> # defense in depth protection at the expense of restricting some flexibil=
ity
> # in your setup (e.g. placement of your configuration files) or possibly
> # reduced performance. See systemd.service(5) and systemd.exec(5) for fur=
ther
> # information.
>=20
> # NoNewPrivileges=3Dtrue
> # ProtectHome=3Dtrue
> # If you want to use 'ProtectSystem=3Dstrict' you should whitelist the PI=
DFILE,
> # any state files and any other files written using 'ReadWritePaths' or
> # 'RuntimeDirectory'.
> # ProtectSystem=3Dtrue
> # ProtectKernelTunables=3Dtrue
> # ProtectKernelModules=3Dtrue
> # ProtectControlGroups=3Dtrue
> # If your SystemD version supports them, you can add: @reboot, @swap, @sy=
nc
> # SystemCallFilter=3D~@cpu-emulation @keyring @module @obsolete @raw-io
>=20
> [Install]
> WantedBy=3Dmulti-user.target

and now:
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su systemd[1]: haproxy.service: s=
tart operation timed out. Terminating.
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [NOTICE]   (9=
23107) : haproxy version is 3.2.6
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [NOTICE]   (9=
23107) : path to executable is /usr/sbin/haproxy
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [WARNING]  (9=
23107) : Exiting Master process...
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [ALERT]    (9=
23107) : Current worker (923109) exited with code 143 (Terminated)
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [WARNING]  (9=
23107) : All workers exited. Exiting... (0)
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su systemd[1]: haproxy.service: F=
ailed with result 'timeout'.
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su systemd[1]: Failed to start HA=
Proxy Load Balancer.
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su systemd[1]: haproxy.service: S=
cheduled restart job, restart counter is at 4100.
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su systemd[1]: Starting HAProxy L=
oad Balancer...
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su haproxy[923407]: [NOTICE]   (9=
23407) : Initializing new worker (923409)
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su haproxy[923407]: [NOTICE]   (9=
23407) : Loading success.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: haproxy.service: s=
tart operation timed out. Terminating.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [NOTICE]   (9=
23407) : haproxy version is 3.2.6
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [NOTICE]   (9=
23407) : path to executable is /usr/sbin/haproxy
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [WARNING]  (9=
23407) : Exiting Master process...
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [ALERT]    (9=
23407) : Current worker (923409) exited with code 143 (Terminated)
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [WARNING]  (9=
23407) : All workers exited. Exiting... (0)
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: haproxy.service: F=
ailed with result 'timeout'.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: Failed to start HA=
Proxy Load Balancer.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: haproxy.service: S=
cheduled restart job, restart counter is at 4101.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: Starting HAProxy L=
oad Balancer...
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923761]: [NOTICE]   (9=
23761) : Initializing new worker (923763)
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923761]: [NOTICE]   (9=
23761) : Loading success.
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su systemd[1]: haproxy.service: s=
tart operation timed out. Terminating.
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [NOTICE]   (9=
23761) : haproxy version is 3.2.6
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [NOTICE]   (9=
23761) : path to executable is /usr/sbin/haproxy
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [WARNING]  (9=
23761) : Exiting Master process...
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [ALERT]    (9=
23761) : Current worker (923763) exited with code 143 (Terminated)
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [WARNING]  (9=
23761) : All workers exited. Exiting... (0)
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su systemd[1]: haproxy.service: F=
ailed with result 'timeout'.
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su systemd[1]: Failed to start HA=
Proxy Load Balancer.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17601150093.e2f2faac2.3495
Date: Fri, 10 Oct 2025 16:50:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1251868

          Summary
          haproxy can start out of the box

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Network

          Assignee
          screening-team-bugs@suse.de

          Reporter
          werwolf131313@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

now in oss haproxy build without systemd notify support:
> [werwolf@gw] ~=20=20
> =E2=9D=AF haproxy -vv                                                 =
                                                                           =
                                                                           =
                                                       =E2=8F=8E
> HAProxy version 3.2.6 2025/10/03 - ht=
tps://haproxy.org/
> Status: long-term supported branch - will stop receiving fixes around =
Q2 2030.
> Known bugs: ht=
tp://www.haproxy.org/bugs/bugs-3.2.6.html
> Running on: Linux 6.17.0-2-default #1 SMP PREEMPT_DYNAMIC Thu Oct  2 0=
8:12:40 UTC 2025 (190326b) x86_64
> Build options :=20
>   TARGET  =3D linux-glibc
>   CC      =3D cc
>   CFLAGS  =3D -O2 -g -fwrapv
>   OPTIONS =3D USE_GETADDRINFO=3D1 USE_OPENSSL=3D1 USE_LUA=3D1 USE_ZLIB=
=3D1 USE_TFO=3D1 USE_NS=3D1 USE_QUIC=3D1 USE_PROMEX=3D1 USE_PCRE2=3D1 USE_P=
CRE2_JIT=3D1 USE_QUIC_OPENSSL_COMPAT=3D1 USE_PIE=3D1 USE_STACKPROTECTOR=3D1=
 USE_RELRO_NOW=3D1
>   DEBUG   =3D=20
>=20
> Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU_AFFINITY=
 +CRYPT_H -DEVICEATLAS +DL -ENGINE +EPOLL -EVPORTS +GETADDRINFO -KQUEUE -LI=
BATOMIC +LIBCRYPT +LINUX_CAP +LINUX_SPLICE +LINUX_TPROXY +LUA +MATH -MEMORY=
_PROFILING +NETFILTER +NS -OBSOLETE_LINKER +OPENSSL -OPENSSL_AWSLC -OPENSSL=
_WOLFSSL -OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT +POLL +PRCTL -PROCCTL +PROME=
X -PTHREAD_EMULATION +QUIC +QUIC_OPENSSL_COMPAT +RT -SLZ +SSL -STATIC_PCRE =
-STATIC_PCRE2 +TFO +THREAD +THREAD_DUMP +TPROXY -WURFL +ZLIB +ACME
>=20
> Default settings :
>   bufsize =3D 16384, maxrewrite =3D 1024, maxpollevents =3D 200
>=20
> Built with multi-threading support (MAX_TGROUPS=3D32, MAX_THREADS=3D10=
24, default=3D4).
> Built with SSL library version : OpenSSL 3.5.3 16 Sep 2025
> Running on SSL library version : OpenSSL 3.5.3 16 Sep 2025
> SSL library supports TLS extensions : yes
> SSL library supports SNI : yes
> SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
> OpenSSL providers loaded : default
> QUIC: connection socket-owner mode support : yes
> QUIC: GSO emission support : yes
> Built with Lua version : Lua 5.4.8
> Built with the Prometheus exporter as a service
> Built with network namespace support.
> Built with zlib version : 1.3.1
> Running on zlib version : 1.3.1
> Compression algorithms supported : identity("identity"), def=
late("deflate"), raw-deflate("deflate"), gzip("gzi=
p")
> Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSP=
ARENT IP_FREEBIND
> Built with PCRE2 version : 10.46 2025-08-27
> PCRE2 library supports JIT : yes
> Encrypted password support via crypt(3): yes
> Built with gcc compiler version 15.2.0
>=20
> Available polling systems :
>       epoll : pref=3D300,  test result OK
>        poll : pref=3D200,  test result OK
>      select : pref=3D150,  test result OK
> Total: 3 (3 usable), will use epoll.
>=20
> Available multiplexer protocols :
> (protocols marked as <default> cannot be specified using 'proto'=
 keyword)
>        quic : mode=3DHTTP  side=3DFE     mux=3DQUIC  flags=3DHTX|NO_UP=
G|FRAMED
>          h2 : mode=3DHTTP  side=3DFE|BE  mux=3DH2    flags=3DHTX|HOL_R=
ISK|NO_UPG
>   <default> : mode=3DHTTP  side=3DFE|BE  mux=3DH1    flags=3DHTX
>          h1 : mode=3DHTTP  side=3DFE|BE  mux=3DH1    flags=3DHTX|NO_UPG
>        fcgi : mode=3DHTTP  side=3DBE     mux=3DFCGI  flags=3DHTX|HOL_R=
ISK|NO_UPG
>   <default> : mode=3DSPOP  side=3DBE     mux=3DSPOP  flags=3DHOL=
_RISK|NO_UPG
>        spop : mode=3DSPOP  side=3DBE     mux=3DSPOP  flags=3DHOL_RISK|=
NO_UPG
>   <default> : mode=3DTCP   side=3DFE|BE  mux=3DPASS  flags=3D
>        none : mode=3DTCP   side=3DFE|BE  mux=3DPASS  flags=3DNO_UPG
>=20
> Available services : prometheus-exporter
> Available filters :
>         [BWLIM] bwlim-in
>         [BWLIM] bwlim-out
>         [CACHE] cache
>         [COMP] compression
>         [FCGI] fcgi-app
>         [SPOE] spoe
>         [TRACE] trace

but systemd service for daemon with systemd support:
> =E2=9D=AF systemctl cat haproxy.service
> # /usr/lib/systemd/system/haproxy.service
> [Unit]
> Description=3DHAProxy Load Balancer
> After=3Dnetwork-online.target
> Wants=3Dnetwork-online.target
>=20
> [Service]
> EnvironmentFile=3D-/etc/default/haproxy
> EnvironmentFile=3D-/etc/sysconfig/haproxy
> Environment=3D"CONFIG=3D/etc/haproxy/haproxy.cfg" "PIDF=
ILE=3D/run/haproxy/pid" "EXTRAOPTS=3D-S /run/haproxy/master.sock&=
quot;
> ExecStart=3D/usr/sbin/haproxy -Ws -f $CONFIG -p $PIDFILE $EXTRAOPTS
> ExecReload=3D/usr/sbin/haproxy -Ws -f $CONFIG -c $EXTRAOPTS
> ExecReload=3D/bin/kill -USR2 $MAINPID
> KillMode=3Dmixed
> Restart=3Dalways
> SuccessExitStatus=3D143
> Type=3Dnotify
>=20
> # The following lines leverage SystemD's sandboxing options to provide
> # defense in depth protection at the expense of restricting some flexi=
bility
> # in your setup (e.g. placement of your configuration files) or possib=
ly
> # reduced performance. See systemd.service(5) and systemd.exec(5) for =
further
> # information.
>=20
> # NoNewPrivileges=3Dtrue
> # ProtectHome=3Dtrue
> # If you want to use 'ProtectSystem=3Dstrict' you should whitelist the=
 PIDFILE,
> # any state files and any other files written using 'ReadWritePaths' or
> # 'RuntimeDirectory'.
> # ProtectSystem=3Dtrue
> # ProtectKernelTunables=3Dtrue
> # ProtectKernelModules=3Dtrue
> # ProtectControlGroups=3Dtrue
> # If your SystemD version supports them, you can add: @reboot, &#6=
4;swap, @sync
> # SystemCallFilter=3D~@cpu-emulation @keyring @module &#64=
;obsolete @raw-io
>=20
> [Install]
> WantedBy=3Dmulti-user.target

and now:
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su syste=
md[1]: haproxy.service: start operation timed out. Terminating.
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [NOTICE]  =
 (923107) : haproxy version is 3.2.6
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [NOTICE]  =
 (923107) : path to executable is /usr/sbin/haproxy
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [WARNING] =
 (923107) : Exiting Master process...
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [ALERT]   =
 (923107) : Current worker (923109) exited with code 143 (Terminated)
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su haproxy[923107]: [WARNING] =
 (923107) : All workers exited. Exiting... (0)
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su systemd[1]: haproxy.service=
: Failed with result 'timeout'.
> =D0=BE=D0=BA=D1=82 10 21:45:11 gw.itrus.su systemd[1]: Failed to start=
 HAProxy Load Balancer.
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su systemd[1]: haproxy.service=
: Scheduled restart job, restart counter is at 4100.
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su systemd[1]: Starting HAProx=
y Load Balancer...
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su haproxy[923407]: [NOTICE]  =
 (923407) : Initializing new worker (923409)
> =D0=BE=D0=BA=D1=82 10 21:45:12 gw.itrus.su haproxy[923407]: [NOTICE]  =
 (923407) : Loading success.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: haproxy.service=
: start operation timed out. Terminating.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [NOTICE]  =
 (923407) : haproxy version is 3.2.6
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [NOTICE]  =
 (923407) : path to executable is /usr/sbin/haproxy
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [WARNING] =
 (923407) : Exiting Master process...
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [ALERT]   =
 (923407) : Current worker (923409) exited with code 143 (Terminated)
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923407]: [WARNING] =
 (923407) : All workers exited. Exiting... (0)
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: haproxy.service=
: Failed with result 'timeout'.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: Failed to start=
 HAProxy Load Balancer.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: haproxy.service=
: Scheduled restart job, restart counter is at 4101.
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su systemd[1]: Starting HAProx=
y Load Balancer...
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923761]: [NOTICE]  =
 (923761) : Initializing new worker (923763)
> =D0=BE=D0=BA=D1=82 10 21:46:42 gw.itrus.su haproxy[923761]: [NOTICE]  =
 (923761) : Loading success.
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su systemd[1]: haproxy.service=
: start operation timed out. Terminating.
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [NOTICE]  =
 (923761) : haproxy version is 3.2.6
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [NOTICE]  =
 (923761) : path to executable is /usr/sbin/haproxy
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [WARNING] =
 (923761) : Exiting Master process...
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [ALERT]   =
 (923761) : Current worker (923763) exited with code 143 (Terminated)
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su haproxy[923761]: [WARNING] =
 (923761) : All workers exited. Exiting... (0)
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su systemd[1]: haproxy.service=
: Failed with result 'timeout'.
> =D0=BE=D0=BA=D1=82 10 21:48:12 gw.itrus.su systemd[1]: Failed to start=
 HAProxy Load Balancer.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17601150093.e2f2faac2.3495--

summary: haproxy can start out of the box


--17601187710.6ff81A.3555
Date: Fri, 10 Oct 2025 17:52:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1251869

            Bug ID: 1251869
           Summary: Cannot update to latest plasma 6.5 beta 2 rpms from OBS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: vkrevs-at-yahoo.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This is basically same as https://bugzilla.opensuse.org/show_bug.cgi?id=3D1=
240759
only for Plasma 6.5 Beta 2 and Qt 6.10.

$ zypper lr --uri | grep KDE
 4 | KDE:Applications_openSUSE_Leap_15.6           |
KDE:Applications_openSUSE_Leap_15.6                          | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Applications/KDE_Frameworks5_ope=
nSUSE_Leap_15.6/
 5 | KDE:Extra_openSUSE_Leap_15.6                  |
KDE:Extra_openSUSE_Leap_15.6                                 | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Extra/KDE_Applications_openSUSE_=
Leap_15.6/
 6 | KDE:Frameworks5_openSUSE_Leap_15.6            |
KDE:Frameworks5_openSUSE_Leap_15.6                           | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Frameworks5/openSUSE_Leap_15.6/
 7 | KDE:Frameworks_openSUSE_Leap_15.6             |
KDE:Frameworks_openSUSE_Leap_15.6                            | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Frameworks/openSUSE_Leap_15.6/
 8 | KDE:Qt5_openSUSE_Leap_15.6                    | KDE:Qt5_openSUSE_Leap_=
15.6
                                  | Yes     | (r ) Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Qt5/openSUSE_Leap_15.6
 9 | KDE:Qt6_openSUSE_Leap_15.6                    | KDE:Qt6_openSUSE_Leap_=
15.6
                                  | Yes     | (r ) Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Qt6/openSUSE_Leap_15.6

My current leap 15.6 system has been updated successfully to the latest Pla=
sma
6.5 beta 2 rpms before the Qt 6.10 update in OBS.

Now, trying to perform a "zypper -v dup -d" results in

Warning: You are about to do a distribution upgrade with all enabled
repositories. Make sure these repositories are compatible before you contin=
ue.
See 'man zypper' for more information about this command.
Computing distribution upgrade...
Force resolution: No
Computing upgrade...
6 Problems:
Problem: 1: the installed libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64 requires
'libQt6Gui.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cannot =
be
provided
deleted providers: libQt6Gui6-6.9.2-lp156.158.4.x86_64

Problem: 2: the installed libQt6Gui6-6.9.2-lp156.158.4.x86_64 requires
'libQt6Core.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cannot=
 be
provided
deleted providers: libQt6Core6-6.9.2-lp156.158.4.x86_64

Problem: 3: the installed libQt6Gui6-6.9.2-lp156.158.4.x86_64 requires
'libQt6DBus6 =3D 6.9.2', but this requirement cannot be provided
deleted providers: libQt6DBus6-6.9.2-lp156.158.4.x86_64

Problem: 4: the to be installed
libQt6WaylandEglClientHwIntegration6-6.6.3-150600.1.4.x86_64 requires
'libQt6Gui.so.6(Qt_6.6.3_PRIVATE_API)(64bit)', but this requirement cannot =
be
provided
not installable providers:
libQt6Gui6-6.6.3-150600.1.18.x86_64[openSUSE:repo-oss]
                   libQt6Gui6-6.6.3-150600.3.3.1.x86_64[openSUSE:update-sle]

Problem: 5: the installed libQt6Gui6-6.9.2-lp156.158.4.x86_64 requires
'libQt6OpenGL.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cann=
ot
be provided
deleted providers: libQt6OpenGL6-6.9.2-lp156.158.4.x86_64

Problem: 6: the installed libQt6OpenGL6-6.9.2-lp156.158.4.x86_64 requires
'libQt6Widgets6 =3D 6.9.2', but this requirement cannot be provided
deleted providers: libQt6Widgets6-6.9.2-lp156.158.4.x86_64

Problem: 1: the installed libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64 requires
'libQt6Gui.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cannot =
be
provided
deleted providers: libQt6Gui6-6.9.2-lp156.158.4.x86_64

 Solution 1: Following actions will be done:
  keep obsolete libQt6Gui6-6.9.2-lp156.158.4.x86_64
  keep obsolete qt6-network-tls-6.9.2-lp156.158.4.x86_64
  keep obsolete qt6-networkinformation-glib-6.9.2-lp156.158.4.x86_64
  keep obsolete qt6-networkinformation-nm-6.9.2-lp156.158.4.x86_64
 Solution 2: deinstallation of libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64
 Solution 3: break libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64 by ignoring so=
me
of its dependencies

Choose from above solutions by number or skip, retry or cancel
[1/2/3/s/r/c/d/?] (c): 2

By experimentation, I can get it to resolve all conflicts by choosing to
uninstall anything related to digikam, showfoto and
libQt6WaylandEglClientHwIntegration6, so the final result is something like:

The following 1190 packages are going to be upgraded:
  AppStream                                 1.1.1-lp156.2.1 -> 1.1.1-lp156.=
2.2
...=20
  yt-dlp                                    2025.09.26-150600.2.pm.1 ->
2025.09.26-150600.3.pm.1

The following 2 packages are going to be downgraded:
  libpackagekitqt6-1   1.1.3-lp156.3.2 -> 1.1.1-bp156.1.4
  xwaylandvideobridge  0.4.0+git12-kf.15.18 -> 0.4.0+git12-bp156.1.3

The following 2 packages are going to change vendor:
  libpackagekitqt6-1   1.1.3-lp156.3.2 -> 1.1.1-bp156.1.4=20=20=20=20=20=20=
=20=20=20=20=20=20
obs://build.opensuse.org/KDE -> openSUSE
  xwaylandvideobridge  0.4.0+git12-kf.15.18 -> 0.4.0+git12-bp156.1.3=20
obs://build.opensuse.org/KDE:Extra -> openSUSE

The following 3 NEW packages are going to be installed:
  gcc14-PIE                14.3.0+git11799-150000.1.11.1
  libQt6LabsSynchronizer6  6.10.0-lp156.117.1
  libpackagekitqt6-2       1.1.4-lp156.2.2

The following 6 packages are going to be REMOVED:
  digikam                               8.7.0-kf.263.8
  digikam-lang                          8.7.0-kf.263.8
  digikam-plugins                       8.7.0-kf.263.8
  libQt6WaylandEglClientHwIntegration6  6.9.2-lp156.98.3
  libdigikamcore8_7_0                   8.7.0-kf.263.8
  showfoto                              8.7.0-kf.263.8

1190 packages to upgrade, 2 to downgrade, 3 new, 6 to remove, 2  to change
vendor.

Package download size:    2.20 GiB

Download only.

Backend:  classic_rpmtrans --download-only
Continue? [y/n/v/...? shows all options] (y):=20

Is this the expected procedure or should I wait till more errors are resolv=
ed
in OBS KDE repos (kcalc/ktorrent/xwaylandbridge failing to build, etc)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17601187710.6ff81A.3555
Date: Fri, 10 Oct 2025 17:52:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1251869

          Summary
          Cannot update to latest plasma 6.5 beta 2 rpms from OBS

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KDE Workspace (Plasma)

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          vkrevs@yahoo.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This is basically same as https://bugzilla.opensuse.org/show_bug.cg=
i?id=3D1240759
only for Plasma 6.5 Beta 2 and Qt 6.10.

$ zypper lr --uri | grep KDE
 4 | KDE:Applications_openSUSE_Leap_15.6           |
KDE:Applications_openSUSE_Leap_15.6                          | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/App=
lications/KDE_Frameworks5_openSUSE_Leap_15.6/
 5 | KDE:Extra_openSUSE_Leap_15.6                  |
KDE:Extra_openSUSE_Leap_15.6                                 | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Extra/KDE=
_Applications_openSUSE_Leap_15.6/
 6 | KDE:Frameworks5_openSUSE_Leap_15.6            |
KDE:Frameworks5_openSUSE_Leap_15.6                           | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Frameworks5/openSUSE=
_Leap_15.6/
 7 | KDE:Frameworks_openSUSE_Leap_15.6             |
KDE:Frameworks_openSUSE_Leap_15.6                            | Yes     | (r=
 )
Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Frameworks/openSUSE_L=
eap_15.6/
 8 | KDE:Qt5_openSUSE_Leap_15.6                    | KDE:Qt5_openSUSE_Leap_=
15.6
                                  | Yes     | (r ) Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Qt5/openSUSE_Leap_15.6
 9 | KDE:Qt6_openSUSE_Leap_15.6                    | KDE:Qt6_openSUSE_Leap_=
15.6
                                  | Yes     | (r ) Yes  | Yes     |
https://cdn.opensuse.org/repositories/KDE:/Qt6/openSUSE_Leap_15.6

My current leap 15.6 system has been updated successfully to the latest Pla=
sma
6.5 beta 2 rpms before the Qt 6.10 update in OBS.

Now, trying to perform a "zypper -v dup -d" results in

Warning: You are about to do a distribution upgrade with all enabled
repositories. Make sure these repositories are compatible before you contin=
ue.
See 'man zypper' for more information about this command.
Computing distribution upgrade...
Force resolution: No
Computing upgrade...
6 Problems:
Problem: 1: the installed libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64 requires
'libQt6Gui.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cannot =
be
provided
deleted providers: libQt6Gui6-6.9.2-lp156.158.4.x86_64

Problem: 2: the installed libQt6Gui6-6.9.2-lp156.158.4.x86_64 requires
'libQt6Core.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cannot=
 be
provided
deleted providers: libQt6Core6-6.9.2-lp156.158.4.x86_64

Problem: 3: the installed libQt6Gui6-6.9.2-lp156.158.4.x86_64 requires
'libQt6DBus6 =3D 6.9.2', but this requirement cannot be provided
deleted providers: libQt6DBus6-6.9.2-lp156.158.4.x86_64

Problem: 4: the to be installed
libQt6WaylandEglClientHwIntegration6-6.6.3-150600.1.4.x86_64 requires
'libQt6Gui.so.6(Qt_6.6.3_PRIVATE_API)(64bit)', but this requirement cannot =
be
provided
not installable providers:
libQt6Gui6-6.6.3-150600.1.18.x86_64[openSUSE:repo-oss]
                   libQt6Gui6-6.6.3-150600.3.3.1.x86_64[openSUSE:update-sle]

Problem: 5: the installed libQt6Gui6-6.9.2-lp156.158.4.x86_64 requires
'libQt6OpenGL.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cann=
ot
be provided
deleted providers: libQt6OpenGL6-6.9.2-lp156.158.4.x86_64

Problem: 6: the installed libQt6OpenGL6-6.9.2-lp156.158.4.x86_64 requires
'libQt6Widgets6 =3D 6.9.2', but this requirement cannot be provided
deleted providers: libQt6Widgets6-6.9.2-lp156.158.4.x86_64

Problem: 1: the installed libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64 requires
'libQt6Gui.so.6(Qt_6.9.2_PRIVATE_API)(64bit)', but this requirement cannot =
be
provided
deleted providers: libQt6Gui6-6.9.2-lp156.158.4.x86_64

 Solution 1: Following actions will be done:
  keep obsolete libQt6Gui6-6.9.2-lp156.158.4.x86_64
  keep obsolete qt6-network-tls-6.9.2-lp156.158.4.x86_64
  keep obsolete qt6-networkinformation-glib-6.9.2-lp156.158.4.x86_64
  keep obsolete qt6-networkinformation-nm-6.9.2-lp156.158.4.x86_64
 Solution 2: deinstallation of libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64
 Solution 3: break libdigikamcore8_7_0-8.7.0-kf.263.8.x86_64 by ignoring so=
me
of its dependencies

Choose from above solutions by number or skip, retry or cancel
[1/2/3/s/r/c/d/?] (c): 2

By experimentation, I can get it to resolve all conflicts by choosing to
uninstall anything related to digikam, showfoto and
libQt6WaylandEglClientHwIntegration6, so the final result is something like:

The following 1190 packages are going to be upgraded:
  AppStream                                 1.1.1-lp156.2.1 -> 1.1.1-lp1=
56.2.2
...=20
  yt-dlp                                    2025.09.26-150600.2.pm.1 ->
2025.09.26-150600.3.pm.1

The following 2 packages are going to be downgraded:
  libpackagekitqt6-1   1.1.3-lp156.3.2 -> 1.1.1-bp156.1.4
  xwaylandvideobridge  0.4.0+git12-kf.15.18 -> 0.4.0+git12-bp156.1.3

The following 2 packages are going to change vendor:
  libpackagekitqt6-1   1.1.3-lp156.3.2 -> 1.1.1-bp156.1.4=20=20=20=20=20=
=20=20=20=20=20=20=20
obs://build.opensuse.org/KDE -> openSUSE
  xwaylandvideobridge  0.4.0+git12-kf.15.18 -> 0.4.0+git12-bp156.1.3=20
obs://build.opensuse.org/KDE:Extra -> openSUSE

The following 3 NEW packages are going to be installed:
  gcc14-PIE                14.3.0+git11799-150000.1.11.1
  libQt6LabsSynchronizer6  6.10.0-lp156.117.1
  libpackagekitqt6-2       1.1.4-lp156.2.2

The following 6 packages are going to be REMOVED:
  digikam                               8.7.0-kf.263.8
  digikam-lang                          8.7.0-kf.263.8
  digikam-plugins                       8.7.0-kf.263.8
  libQt6WaylandEglClientHwIntegration6  6.9.2-lp156.98.3
  libdigikamcore8_7_0                   8.7.0-kf.263.8
  showfoto                              8.7.0-kf.263.8

1190 packages to upgrade, 2 to downgrade, 3 new, 6 to remove, 2  to change
vendor.

Package download size:    2.20 GiB

Download only.

Backend:  classic_rpmtrans --download-only
Continue? [y/n/v/...? shows all options] (y):=20

Is this the expected procedure or should I wait till more errors are resolv=
ed
in OBS KDE repos (kcalc/ktorrent/xwaylandbridge failing to build, etc)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17601187710.6ff81A.3555--


--17601232850.A6fE.3693
Date: Fri, 10 Oct 2025 19:08:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1251891

            Bug ID: 1251891
           Summary: VUL-0: CVE-2025-11579: hauler: github.com/nwaples/rardecode: failure to restrict the dictionary size when processing RAR files allows for excessive memory consumpti
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/476646/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com, security-team-at-suse.de
            Blocks: 1251871
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1251871 +++

github.com/nwaples/rardecode versions <=3D2.1.1 fail to restrict the dictio=
nary
size when reading large RAR dictionary sizes, which allows an attacker to
provide a specially crafted RAR file and cause Denial of Service via an Out=
 Of
Memory Crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-11579
https://www.cve.org/CVERecord?id=3DCVE-2025-11579
https://github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39=
ab11df9a9
https://bugzilla.redhat.com/show_bug.cgi?id=3D2403068
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17601232850.A6fE.3693
Date: Fri, 10 Oct 2025 19:08:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1251891

          Summary
          VUL-0: CVE-2025-11579: hauler: github.com/nwaples/rardecode: =
failure to restrict the dictionary size when processing RAR files allows fo=
r excessive memory consumpti

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/476646/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com, security-team@suse.de

          Blocks
          1251871

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1251871 +++

github.com/nwaples/rardecode versions <=3D2.1.1 fail to restrict the dic=
tionary
size when reading large RAR dictionary sizes, which allows an attacker to
provide a specially crafted RAR file and cause Denial of Service via an Out=
 Of
Memory Crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-11579
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-11579
https://github.com/nwaples/rardecode/commit/52fb4e825=
c936636f251f7e7deded39ab11df9a9
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2403068

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17601232850.A6fE.3693--


--17603425613.0C358.5566
Date: Mon, 13 Oct 2025 08:02:41 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1251923

            Bug ID: 1251923
           Summary: [Build 20251008][SElinux] MicroOS / tukit snapper plugin denied
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/5373227/modules/perl
                    _bootloader/steps/26
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

This went a bit under with the recent grub2 / selinux related issues, but t=
here
is one more test failing differently - issue introduced with
https://build.opensuse.org/package/rdiff/openSUSE:Factory/selinux-policy?li=
nkrev=3Dbase&rev=3D127

 7+  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)

The snapper plugin get's a denied on cleanup:

type=3DAVC msg=3Daudit(1760341773.500:107): avc:  denied  { getattr } for  =
pid=3D1594
comm=3D"rm" path=3D"/.snapshots/4/snapshot/etc/sysconfig/network/scripts"
dev=3D"sda3" ino=3D417 scontext=3Dsystem_u:system_r:snapper_tu_etc_plugin_t=
:s0
tcontext=3Dsystem_u:object_r:wicked_script_t:s0 tclass=3Ddir permissive=3D0

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-x86_64-microos-old2microosnext@uefi fails =
in
[perl_bootloader](https://openqa.opensuse.org/tests/5373227/modules/perl_bo=
otloader/steps/26)

## Test suite description
Boot from existing, static MicroOS image and transactional-update dup to
snapshot under test

## Reproducible

Fails since (at least) Build
[20251008](https://openqa.opensuse.org/tests/5373227) (current job)

## Expected result

Last good: [20251007](https://openqa.opensuse.org/tests/5370675) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dmi=
croos&flavor=3DMicroOS-Image&machine=3Duefi&test=3Dmicroos-old2microosnext&=
version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17603425613.0C358.5566
Date: Mon, 13 Oct 2025 08:02:41 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1251923

          Summary
          [Build 20251008][SElinux] MicroOS / tukit snapper plugin deni=
ed

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/5373227/modules/perl_bootlo=
ader/steps/26

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

This went a bit under with the recent grub2 / selinux related issues, but t=
here
is one more test failing differently - issue introduced with
https://build.opensuse.org/package/r=
diff/openSUSE:Factory/selinux-policy?linkrev=3Dbase&rev=3D127

 7+  * Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)

The snapper plugin get's a denied on cleanup:

type=3DAVC msg=3Daudit(1760341773.500:107): avc:  denied  { getattr } for  =
pid=3D1594
comm=3D"rm" path=3D"/.snapshots/4/snapshot/etc/sysconfig/net=
work/scripts"
dev=3D"sda3" ino=3D417 scontext=3Dsystem_u:system_r:snapper_tu_et=
c_plugin_t:s0
tcontext=3Dsystem_u:object_r:wicked_script_t:s0 tclass=3Ddir permissive=3D0

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-x86_64-microos-old2microosnext@uefi fa=
ils in
[perl_bootloader](https://openqa.opensuse.org/tests/5373227/mod=
ules/perl_bootloader/steps/26)

## Test suite description
Boot from existing, static MicroOS image and transactional-update dup to
snapshot under test

## Reproducible

Fails since (at least) Build
[20251008](https://op=
enqa.opensuse.org/tests/5373227) (current job)

## Expected result

Last good: [20251007](https://openqa.opensuse.org/tests/5370675) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensus=
e.org/tests/latest?arch=3Dx86_64&distri=3Dmicroos&flavor=3DMicroOS-=
Image&machine=3Duefi&test=3Dmicroos-old2microosnext&version=3DT=
umbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17603425613.0C358.5566--


--17603587681.5aAC31e8.6436
Date: Mon, 13 Oct 2025 12:32:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1251952

            Bug ID: 1251952
           Summary: [SELinux] fail2ban: labels under /srv/docker/...
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: filippo.bonazzi-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: filippo.bonazzi-at-suse.com, Sauerlandlinux-at-gmx.de,
                    SchwarzerA@messe-duesseldorf.de,
                    selinux-maintainers-at-suse.de
        Depends on: 1251902
            Blocks: 1251951
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1251902 +++

I'm using openSUSE Tumbleweed with the last possible updates and switched f=
rom
Apparmor to SElinux following the instructions on
https://en.opensuse.org/Portal:SELinux/Setup

time->Sat Oct 11 20:28:05 2025
type=3DAVC msg=3Daudit(1760207285.879:724): avc:  denied  { getattr } for  =
pid=3D1999
comm=3D"f2b/f.paperless"
path=3D"/srv/docker/paperless-ngx/persistent/data/log/paperless.log" dev=3D=
"dm-1"
ino=3D393223 scontext=3Dsystem_u:system_r:fail2ban_t:s0
tcontext=3Dsystem_u:object_r:var_t:s0 tclass=3Dfile permissive=3D1
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17603587681.5aAC31e8.6436
Date: Mon, 13 Oct 2025 12:32:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1251952

          Summary
          [SELinux] fail2ban: labels under /srv/docker/...

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          filippo.bonazzi@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          filippo.bonazzi@suse.com, Sauerlandlinux@gmx.de, Schw=
arzerA@messe-duesseldorf.de, selinux-maintainers@suse.de

          Depends on
          1251902

          Blocks
          1251951

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1251902 +++

I'm using openSUSE Tumbleweed with the last possible updates and switched f=
rom
Apparmor to SElinux following the instructions on
https://en.opensus=
e.org/Portal:SELinux/Setup

time->Sat Oct 11 20:28:05 2025
type=3DAVC msg=3Daudit(1760207285.879:724): avc:  denied  { getattr } for  =
pid=3D1999
comm=3D"f2b/f.paperless"
path=3D"/srv/docker/paperless-ngx/persistent/data/log/paperless.log&qu=
ot; dev=3D"dm-1"
ino=3D393223 scontext=3Dsystem_u:system_r:fail2ban_t:s0
tcontext=3Dsystem_u:object_r:var_t:s0 tclass=3Dfile permissive=3D1

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17603587681.5aAC31e8.6436--


body:
--17604653033.3514e56.9341
Date: Tue, 14 Oct 2025 18:08:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252006

            Bug ID: 1252006
           Summary: Internal Compiler Error in package afl
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: S/390-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ada.lovelace-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

We are receiving an Internal Compiler Error since the last package update on
s390x in the package afl.

Error message:
[  214s] cc  -O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3D3
-fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables
-fstack-clash-protection -Werror=3Dreturn-type -flto=3Dauto -g -fno-lto -g
-Wno-pointer-sign -Wno-variadic-macros -Wall -Wextra -Wno-pointer-arith -fP=
IC
-I include/ -DAFL_PATH=3D\"/usr/libexec/afl\" -DBIN_PATH=3D\"/usr/bin\"
-DDOC_PATH=3D\"/usr/share/doc/packages/afl\"  -flto  src/afl-fuzz-bitmap.c
src/afl-fuzz-cmplog.c src/afl-fuzz-extras.c src/afl-fuzz-ijon.c
src/afl-fuzz-init.c src/afl-fuzz-mutators.c src/afl-fuzz-one.c
src/afl-fuzz-python.c src/afl-fuzz-queue.c src/afl-fuzz-redqueen.c
src/afl-fuzz-run.c src/afl-fuzz-sanfuzz.c src/afl-fuzz-skipdet.c
src/afl-fuzz-state.c src/afl-fuzz-stats.c src/afl-fuzz-statsd.c src/afl-fuz=
z.c
src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performan=
ce.o
-o afl-fuzz -DUSE_PYTHON -I/usr/include/python3.13 -I/usr/include/python3.13
-ldl -lrt -lm -lpython3.13 -ldl  -lm   -L/usr/lib64 -lpython3.13 -ldl  -lm=
=20
-DPYTHON_VERSION=3D"\"Python 3.13.7\"" -ldl -lrt -lm -lm
[  220s] In function =E2=80=98read=E2=80=99,
[  220s]     inlined from =E2=80=98main=E2=80=99 at src/afl-fuzz.c:2947:7:
[  220s] /usr/include/bits/unistd.h:32:10: warning: =E2=80=98__read_alias=
=E2=80=99 writing 96
bytes into a region of size 1 overflows the destination [-Wstringop-overflo=
w=3D]
[  220s]    32 |   return __glibc_fortify (read, __nbytes, sizeof (char),
[  220s]       |          ^
[  220s] include/afl-fuzz.h: In function =E2=80=98main=E2=80=99:
[  220s] include/afl-fuzz.h:215:6: note: destination object =E2=80=98colori=
zed=E2=80=99 of size
1
[  220s]   215 |   u8 colorized,                         /* Do not run redq=
ueen
stage again  */
[  220s]       |      ^
[  220s] /usr/include/bits/unistd-decl.h:29:16: note: in a call to function
=E2=80=98__read_alias=E2=80=99 declared with attribute =E2=80=98access (wri=
te_only, 2, 3)=E2=80=99
[  220s]    29 | extern ssize_t __REDIRECT_FORTIFY (__read_alias, (int __fd,
void *__buf,
[  220s]       |                ^
[  220s] In function =E2=80=98read=E2=80=99,
[  220s]     inlined from =E2=80=98main=E2=80=99 at src/afl-fuzz.c:2947:7:
[  220s] /usr/include/bits/unistd.h:32:10: warning: =E2=80=98__read_chk=E2=
=80=99 writing 96
bytes into a region of size 1 overflows the destination [-Wstringop-overflo=
w=3D]
[  220s]    32 |   return __glibc_fortify (read, __nbytes, sizeof (char),
[  220s]       |          ^
[  220s] include/afl-fuzz.h: In function =E2=80=98main=E2=80=99:
[  220s] include/afl-fuzz.h:215:6: note: destination object =E2=80=98colori=
zed=E2=80=99 of size
1
[  220s]   215 |   u8 colorized,                         /* Do not run redq=
ueen
stage again  */
[  220s]       |      ^
[  220s] /usr/include/bits/unistd-decl.h:26:16: note: in a call to function
=E2=80=98__read_chk=E2=80=99 declared with attribute =E2=80=98access (write=
_only, 2, 3)=E2=80=99
[  220s]    26 | extern ssize_t __read_chk (int __fd, void *__buf, size_t
__nbytes,
[  220s]       |                ^
[  221s] during RTL pass: final
[  221s] src/afl-fuzz-redqueen.c: In function =E2=80=98input_to_state_stage=
=E2=80=99:
[  221s] src/afl-fuzz-redqueen.c:3311:1: internal compiler error: in
print_addrstyle_operand, at config/s390/s390.cc:8312
[  221s]  3311 | }
[  221s]       | ^
[  221s] 0x17b474d diagnostic_context::diagnostic_impl(rich_location*,
diagnostic_metadata const*, diagnostic_option_id, char const*, __va_list_tag
(*) [1], diagnostic_t)
[  221s]        ???:0
[  221s] 0x1785b0b internal_error(char const*, ...)
[  221s]        ???:0
[  221s] 0x173145f fancy_abort(char const*, int, char const*)
[  221s]        ???:0
[  221s] 0x1dd88c1 print_operand(_IO_FILE*, rtx_def*, int)
[  221s]        ???:0
[  221s] 0x1dd78b5 output_operand(rtx_def*, int)
[  221s]        ???:0
[  221s] 0x1dd7461 output_asm_insn(char const*, rtx_def**)
[  221s]        ???:0
[  221s] Please submit a full bug report, with preprocessed source (by using
-freport-bug).
[  221s] Please include the complete backtrace with any bug report.
[  221s] See <https://bugs.opensuse.org/> for instructions.
[  221s] make[1]: *** [/tmp/ccz0aTen.mk:6: /tmp/ccLeEkgP.ltrans2.ltrans.o]
Error 1
[  221s] make[1]: *** Waiting for unfinished jobs....
[  222s] lto-wrapper: fatal error: make returned 2 exit status
[  222s] compilation terminated.
[  222s]
/usr/lib64/gcc/s390x-suse-linux/15/../../../../s390x-suse-linux/bin/ld: err=
or:
lto-wrapper failed
[  222s] collect2: error: ld returned 1 exit status
[  222s] make: *** [GNUmakefile:493: afl-fuzz] Error 1

Build log:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:zSystems=
/afl/standard/s390x

@Richard Can you help us here or should I forward it to IBM?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17604653033.3514e56.9341
Date: Tue, 14 Oct 2025 18:08:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252006

          Summary
          Internal Compiler Error in package afl

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          S/390-64

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          ada.lovelace@gmx.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

We are receiving an Internal Compiler Error since the last p=
ackage update on
s390x in the package afl.

Error message:
[  214s] cc  -O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3D3
-fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables
-fstack-clash-protection -Werror=3Dreturn-type -flto=3Dauto -g -fno-lto -g
-Wno-pointer-sign -Wno-variadic-macros -Wall -Wextra -Wno-pointer-arith -fP=
IC
-I include/ -DAFL_PATH=3D\"/usr/libexec/afl\" -DBIN_PATH=3D\&quot=
;/usr/bin\"
-DDOC_PATH=3D\"/usr/share/doc/packages/afl\"  -flto  src/afl-fuzz=
-bitmap.c
src/afl-fuzz-cmplog.c src/afl-fuzz-extras.c src/afl-fuzz-ijon.c
src/afl-fuzz-init.c src/afl-fuzz-mutators.c src/afl-fuzz-one.c
src/afl-fuzz-python.c src/afl-fuzz-queue.c src/afl-fuzz-redqueen.c
src/afl-fuzz-run.c src/afl-fuzz-sanfuzz.c src/afl-fuzz-skipdet.c
src/afl-fuzz-state.c src/afl-fuzz-stats.c src/afl-fuzz-statsd.c src/afl-fuz=
z.c
src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performan=
ce.o
-o afl-fuzz -DUSE_PYTHON -I/usr/include/python3.13 -I/usr/include/python3.13
-ldl -lrt -lm -lpython3.13 -ldl  -lm   -L/usr/lib64 -lpython3.13 -ldl  -lm=
=20
-DPYTHON_VERSION=3D"\"Python 3.13.7\"" -ldl -lrt -lm -lm
[  220s] In function =E2=80=98read=E2=80=99,
[  220s]     inlined from =E2=80=98main=E2=80=99 at src/afl-fuzz.c:2947:7:
[  220s] /usr/include/bits/unistd.h:32:10: warning: =E2=80=98__read_alias=
=E2=80=99 writing 96
bytes into a region of size 1 overflows the destination [-Wstringop-overflo=
w=3D]
[  220s]    32 |   return __glibc_fortify (read, __nbytes, sizeof (char),
[  220s]       |          ^
[  220s] include/afl-fuzz.h: In function =E2=80=98main=E2=80=99:
[  220s] include/afl-fuzz.h:215:6: note: destination object =E2=80=98colori=
zed=E2=80=99 of size
1
[  220s]   215 |   u8 colorized,                         /* Do not run redq=
ueen
stage again  */
[  220s]       |      ^
[  220s] /usr/include/bits/unistd-decl.h:29:16: note: in a call to function
=E2=80=98__read_alias=E2=80=99 declared with attribute =E2=80=98access (wri=
te_only, 2, 3)=E2=80=99
[  220s]    29 | extern ssize_t __REDIRECT_FORTIFY (__read_alias, (int __fd,
void *__buf,
[  220s]       |                ^
[  220s] In function =E2=80=98read=E2=80=99,
[  220s]     inlined from =E2=80=98main=E2=80=99 at src/afl-fuzz.c:2947:7:
[  220s] /usr/include/bits/unistd.h:32:10: warning: =E2=80=98__read_chk=E2=
=80=99 writing 96
bytes into a region of size 1 overflows the destination [-Wstringop-overflo=
w=3D]
[  220s]    32 |   return __glibc_fortify (read, __nbytes, sizeof (char),
[  220s]       |          ^
[  220s] include/afl-fuzz.h: In function =E2=80=98main=E2=80=99:
[  220s] include/afl-fuzz.h:215:6: note: destination object =E2=80=98colori=
zed=E2=80=99 of size
1
[  220s]   215 |   u8 colorized,                         /* Do not run redq=
ueen
stage again  */
[  220s]       |      ^
[  220s] /usr/include/bits/unistd-decl.h:26:16: note: in a call to function
=E2=80=98__read_chk=E2=80=99 declared with attribute =E2=80=98access (write=
_only, 2, 3)=E2=80=99
[  220s]    26 | extern ssize_t __read_chk (int __fd, void *__buf, size_t
__nbytes,
[  220s]       |                ^
[  221s] during RTL pass: final
[  221s] src/afl-fuzz-redqueen.c: In function =E2=80=98input_to_state_stage=
=E2=80=99:
[  221s] src/afl-fuzz-redqueen.c:3311:1: internal compiler error: in
print_addrstyle_operand, at config/s390/s390.cc:8312
[  221s]  3311 | }
[  221s]       | ^
[  221s] 0x17b474d diagnostic_context::diagnostic_impl(rich_location*,
diagnostic_metadata const*, diagnostic_option_id, char const*, __va_list_tag
(*) [1], diagnostic_t)
[  221s]        ???:0
[  221s] 0x1785b0b internal_error(char const*, ...)
[  221s]        ???:0
[  221s] 0x173145f fancy_abort(char const*, int, char const*)
[  221s]        ???:0
[  221s] 0x1dd88c1 print_operand(_IO_FILE*, rtx_def*, int)
[  221s]        ???:0
[  221s] 0x1dd78b5 output_operand(rtx_def*, int)
[  221s]        ???:0
[  221s] 0x1dd7461 output_asm_insn(char const*, rtx_def**)
[  221s]        ???:0
[  221s] Please submit a full bug report, with preprocessed source (by using
-freport-bug).
[  221s] Please include the complete backtrace with any bug report.
[  221s] See <https://bugs.opensu=
se.org/> for instructions.
[  221s] make[1]: *** [/tmp/ccz0aTen.mk:6: /tmp/ccLeEkgP.ltrans2.ltrans.o]
Error 1
[  221s] make[1]: *** Waiting for unfinished jobs....
[  222s] lto-wrapper: fatal error: make returned 2 exit status
[  222s] compilation terminated.
[  222s]
/usr/lib64/gcc/s390x-suse-linux/15/../../../../s390x-suse-linux/bin/ld: err=
or:
lto-wrapper failed
[  222s] collect2: error: ld returned 1 exit status
[  222s] make: *** [GNUmakefile:493: afl-fuzz] Error 1

Build log:
https://build.opensuse.org/package/live_bui=
ld_log/openSUSE:Factory:zSystems/afl/standard/s390x

@Richard Can you help us here or should I forward it to IBM?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17604653033.3514e56.9341--

summary: Internal Compiler Error in package afl


--17604921970.566A.9575
Date: Wed, 15 Oct 2025 01:36:37 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252012

            Bug ID: 1252012
           Summary: cjpegli: undefined symbol: _ZN7Imf_3_414ChromaticitiesC1ERKN9Imath_3_14Vec2IfEES5 _S5_S5_
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: anenasaa-at-yahoo.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

cjpegli from libjxl-tools package does not open, error message is:
cjpegli: symbol lookup error: cjpegli: undefined symbol:
_ZN7Imf_3_414ChromaticitiesC1ERKN9Imath_3_14Vec2IfEES5_S5_S5_
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17604921970.566A.9575
Date: Wed, 15 Oct 2025 01:36:37 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252012

          Summary
          cjpegli: undefined symbol: _ZN7Imf_3_414ChromaticitiesC1ERKN9=
Imath_3_14Vec2IfEES5_S5_S5_

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          anenasaa@yahoo.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

cjpegli from libjxl-tools package does not open, error messa=
ge is:
cjpegli: symbol lookup error: cjpegli: undefined symbol:
_ZN7Imf_3_414ChromaticitiesC1ERKN9Imath_3_14Vec2IfEES5_S5_S5_

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17604921970.566A.9575--


--17604964981.D9a4ad.9626
Date: Wed, 15 Oct 2025 02:48:18 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252013

            Bug ID: 1252013
           Summary: VUL-0: CVE-2025-11756: chromium: Use after free in Safe Browsing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 16.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: ro-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Fixed in Chromium 141.0.7390.107

CVE-2025-11756: Use after free in Safe Browsing

References:
https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-des=
ktop_14.html
https://issues.chromium.org/issues/447192722
https://chromium.googlesource.com/chromium/src/+/6318e0d832f22409b9be3a5640=
73ef5508ce2184
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17604964981.D9a4ad.9626
Date: Wed, 15 Oct 2025 02:48:18 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252013

          Summary
          VUL-0: CVE-2025-11756: chromium: Use after free in Safe Brows=
ing

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 16.0

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          security-team@suse.de

          CC
          ro@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Fixed in Chromium 141.0.7390.107

CVE-2025-11756: Use after free in Safe Browsing

References:
https://chromereleases.googleblog.com/2025/10/stab=
le-channel-update-for-desktop_14.html
https://issues.chr=
omium.org/issues/447192722
https://chromium.googlesource.com/chromium/src/+=
/6318e0d832f22409b9be3a564073ef5508ce2184

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17604964981.D9a4ad.9626--


body:
--17605154320.Dcc1.10508
Date: Wed, 15 Oct 2025 08:03:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252019

            Bug ID: 1252019
           Summary: Update GoldenDict-NG to the latest
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: akontsevich-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Please update GoldenDict-NG to the latest one - 25.10.x
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17605154320.Dcc1.10508
Date: Wed, 15 Oct 2025 08:03:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252019

          Summary
          Update GoldenDict-NG to the latest

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          screening-team-bugs@suse.de

          Reporter
          akontsevich@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Please update GoldenDict-NG to the latest one - 25.10.x

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17605154320.Dcc1.10508--

summary: Update GoldenDict-NG to the latest


body:
--17605374203.28BeA.11567
Date: Wed, 15 Oct 2025 14:10:20 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252084

            Bug ID: 1252084
           Summary: Missing MODULE_FIRMWARE() for iwlwifi
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 16.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel:Drivers
          Assignee: kernel-bugs-at-suse.de
          Reporter: tiwai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Leap 16.0 installer misses some firmware files for iwlwifi driver models, a=
nd
it's because the kernel module doesn't list all the corresponding firmware
files.

As far as I quickly checked, at least, bz-b0-* models are missing.

The same problem is seen on Tumbleweed installer.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17605374203.28BeA.11567
Date: Wed, 15 Oct 2025 14:10:20 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252084

          Summary
          Missing MODULE_FIRMWARE() for iwlwifi

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 16.0

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel:Drivers

          Assignee
          kernel-bugs@suse.de

          Reporter
          tiwai@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Leap 16.0 installer misses some firmware files for iwlwifi d=
river models, and
it's because the kernel module doesn't list all the corresponding firmware
files.

As far as I quickly checked, at least, bz-b0-* models are missing.

The same problem is seen on Tumbleweed installer.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17605374203.28BeA.11567--

summary: Missing MODULE_FIRMWARE() for iwlwifi


body:
--17609503350.d3a9Da.3278
Date: Mon, 20 Oct 2025 08:52:15 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252306

            Bug ID: 1252306
           Summary: gcc15-go crahses with SIGBUS on armv7hl
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: rguenther-at-suse.com
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: matz-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Running "go-15 version" causes a SIGBUS:

unexpected fault address 0xa4b4f7
fatal error: fault
[signal SIGBUS: bus error code=3D0x1 addr=3D0xa4b4f7 pc=3D0xf741f524]

goroutine 1 [running, locked to thread]:
runtime.dopanic__m
        :0
runtime.throw
        :0
runtime.sigpanic
        :0

        :0

        :0
os.Stat
        :0

This works with GCC 16 and I bisected the fix:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D122345
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17609503350.d3a9Da.3278
Date: Mon, 20 Oct 2025 08:52:15 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252306

          Summary
          gcc15-go crahses with SIGBUS on armv7hl

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          armv7

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          rguenther@suse.com

          Reporter
          fvogt@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          matz@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Running "go-15 version" causes a SIGBUS:

unexpected fault address 0xa4b4f7
fatal error: fault
[signal SIGBUS: bus error code=3D0x1 addr=3D0xa4b4f7 pc=3D0xf741f524]

goroutine 1 [running, locked to thread]:
runtime.dopanic__m
        :0
runtime.throw
        :0
runtime.sigpanic
        :0

        :0

        :0
os.Stat
        :0

This works with GCC 16 and I bisected the fix:
https://g=
cc.gnu.org/bugzilla/show_bug.cgi?id=3D122345

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17609503350.d3a9Da.3278--

summary: gcc15-go crahses with SIGBUS on armv7hl


body:
--17610077740.8Aaa47.4645
Date: Tue, 21 Oct 2025 00:49:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252340

            Bug ID: 1252340
           Summary: Replace luajit2 with luajit
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 16.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mcepl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: dleuenberger-at-suse.com, lubos.kocman-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

There are multiple versions of the Lua interpreter. openSUSE currently pack=
ages
versions 5.1, 5.3, and 5.4 of the original interpreter, developed by Roberto
Ierusalimschy's team at PUC-Rio, alongside multiple versions of LuaJIT.

Lua is one of the fastest and smallest scripting languages available, prima=
rily
designed for embedding within other applications. Unlike most scripting
languages, Lua is register-based, which makes its interpreter incredibly
compact and fast.

This performance was taken even further by LuaJIT, an alternative interpret=
er
created by Mike Pall. By utilizing Just-In-Time (JIT) compilation and
hand-optimizing critical parts of the code in assembly, LuaJIT is frequently
the fastest scripting language in numerous benchmarks. It is widely used in
projects like Neovim and OpenResty, as well as in major enterprises like
Cloudflare and IBM.

Unfortunately, completely in the spirit of https://xkcd.com/2347 none of the
enterprise users of LuaJIT felt a need to employ Mike Pall and given the
complexity of the code, the original Pall=E2=80=99s project is now undermai=
ntained and
only rarely some improvements happen. While openSUSE has long used Mike Pal=
l's
original version, we have decided to switch to the OpenResty fork. This for=
k is
actively maintained, offers wider architecture coverage, and provides a much
more sustainable foundation for the future of LuaJIT within openSUSE.

To reflect this shift, the package names in Factory and in the upcoming ver=
sion
of Leap should be changing:

* The existing `luajit2` package (the OpenResty fork) will be renamed to
`luajit`.

* The existing `luajit` package (Mike Pall's original version) will be move=
d to
`luajit-mike` and removed from Factory. It will remain available in the
`devel:languages:lua` repository for archival purposes (or in the case, that
the upstream development of the original LuaJIT revives).
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17610077740.8Aaa47.4645
Date: Tue, 21 Oct 2025 00:49:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252340

          Summary
          Replace luajit2 with luajit

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 16.0

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          mcepl@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          dleuenberger@suse.com, lubos.kocman@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

There are multiple versions of the Lua interpreter. openSUSE=
 currently packages
versions 5.1, 5.3, and 5.4 of the original interpreter, developed by Roberto
Ierusalimschy's team at PUC-Rio, alongside multiple versions of LuaJIT.

Lua is one of the fastest and smallest scripting languages available, prima=
rily
designed for embedding within other applications. Unlike most scripting
languages, Lua is register-based, which makes its interpreter incredibly
compact and fast.

This performance was taken even further by LuaJIT, an alternative interpret=
er
created by Mike Pall. By utilizing Just-In-Time (JIT) compilation and
hand-optimizing critical parts of the code in assembly, LuaJIT is frequently
the fastest scripting language in numerous benchmarks. It is widely used in
projects like Neovim and OpenResty, as well as in major enterprises like
Cloudflare and IBM.

Unfortunately, completely in the spirit of https://xkcd.com/2347 none of the
enterprise users of LuaJIT felt a need to employ Mike Pall and given the
complexity of the code, the original Pall=E2=80=99s project is now undermai=
ntained and
only rarely some improvements happen. While openSUSE has long used Mike Pal=
l's
original version, we have decided to switch to the OpenResty fork. This for=
k is
actively maintained, offers wider architecture coverage, and provides a much
more sustainable foundation for the future of LuaJIT within openSUSE.

To reflect this shift, the package names in Factory and in the upcoming ver=
sion
of Leap should be changing:

* The existing `luajit2` package (the OpenResty fork) will be renamed to
`luajit`.

* The existing `luajit` package (Mike Pall's original version) will be move=
d to
`luajit-mike` and removed from Factory. It will remain available in the
`devel:languages:lua` repository for archival purposes (or in the case, that
the upstream development of the original LuaJIT revives).

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17610077740.8Aaa47.4645--

summary: Replace luajit2 with luajit


--17610834890.7e0eABb03.6573
Date: Tue, 21 Oct 2025 21:51:29 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252402

            Bug ID: 1252402
           Summary: VUL-0: CVE-2025-12036: chromium: Inappropriate implementation in V8
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 16.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Fixed in Chromium 141.0.7390.122=20

CVE-2025-12036: Inappropriate implementation in V8

References:
https://issues.chromium.org/issues/452296415
https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-des=
ktop_21.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17610834890.7e0eABb03.6573
Date: Tue, 21 Oct 2025 21:51:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252402

          Summary
          VUL-0: CVE-2025-12036: chromium: Inappropriate implementation=
 in V8

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 16.0

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Fixed in Chromium 141.0.7390.122=20

CVE-2025-12036: Inappropriate implementation in V8

References:
https://issues.chr=
omium.org/issues/452296415
https://chromereleases.googleblog.com/2025/10/stab=
le-channel-update-for-desktop_21.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17610834890.7e0eABb03.6573--


--17611323391.E5Bc3280.7614
Date: Wed, 22 Oct 2025 11:25:39 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252435

            Bug ID: 1252435
           Summary: VUL-0: CVE-2025-59438: hashlink: mbedtls: padding oracle attack possible through timing of cipher error reporting
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/478010/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-59438:5.5:(AV:L/AC:L/PR:L/UI:N/
                    S:U/C:H/I:N/A:N)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jaime.marquinez.ferrandiz-at-fastmail.net
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1252433
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.

References:
https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-59438
https://www.cve.org/CVERecord?id=3DCVE-2025-59438
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-secur=
ity-advisory-2025-10-invalid-padding-error/
https://bugzilla.redhat.com/show_bug.cgi?id=3D2405346
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/59xxx/CVE-2025=
-59438.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17611323391.E5Bc3280.7614
Date: Wed, 22 Oct 2025 11:25:39 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252435

          Summary
          VUL-0: CVE-2025-59438: hashlink: mbedtls: padding oracle atta=
ck possible through timing of cipher error reporting

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/478010/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-59438:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:H=
/I:N/A:N)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          jaime.marquinez.ferrandiz@fastmail.net

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1252433

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.

References:
https://mbed-tls.readthedocs.io/en/latest/tech-updates/securit=
y-advisories/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-59438
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-59438
https://mbed-tls.re=
adthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-1=
0-invalid-padding-error/
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2405346
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/59xxx/CVE-2025-59438.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17611323391.E5Bc3280.7614--


--17611477906.21e872Aa.381
Date: Wed, 22 Oct 2025 15:43:10 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252488

            Bug ID: 1252488
           Summary: python-pygraphviz fails to build with graphviz 14.0.0
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Python
          Assignee: python-maintainers-at-suse.com
          Reporter: ana.guerrero-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Current python-pygraphviz in Factory seems to require an update to work with
graphviz 14.0.0 (SR#1313011)

>From the build log:

[   11s]   building 'pygraphviz._graphviz' extension
[   11s]   creating build/temp.linux-x86_64-cpython-311/pygraphviz
[   11s]   gcc -O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3D3
-fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables
-fstack-clash-protection -Werror=3Dreturn-type -flto=3Dauto -g -fPIC
-DSWIG_PYTHON_STRICT_BYTE_CHAR -I/usr/include/python3.11 -c
pygraphviz/graphviz_wrap.c -o
build/temp.linux-x86_64-cpython-311/pygraphviz/graphviz_wrap.o
[   11s]   pygraphviz/graphviz_wrap.c:9:9: warning:
=E2=80=98SWIG_PYTHON_STRICT_BYTE_CHAR=E2=80=99 redefined
[   11s]       9 | #define SWIG_PYTHON_STRICT_BYTE_CHAR
[   11s]         |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
[   11s]   <command-line>: note: this is the location of the previous
definition
[   12s]   pygraphviz/graphviz_wrap.c: In function =E2=80=98_wrap_gvRenderD=
ata=E2=80=99:
[   12s]   pygraphviz/graphviz_wrap.c:5480:50: error: passing argument 5 of
=E2=80=98gvRenderData=E2=80=99 from incompatible pointer type [-Wincompatib=
le-pointer-types]
[   12s]    5480 |   result =3D (int)gvRenderData(arg1,arg2,arg3,arg4,arg5);
[   12s]         |                                                  ^~~~
[   12s]         |                                                  |
[   12s]         |                                                  unsigned
int *
[   12s]   In file included from pygraphviz/graphviz_wrap.c:3024:
[   12s]   /usr/include/graphviz/gvc.h:99:49: note: expected =E2=80=98size_=
t *=E2=80=99 {aka
=E2=80=98long unsigned int *=E2=80=99} but argument is of type =E2=80=98uns=
igned int *=E2=80=99
[   12s]      99 |                          char **result, size_t *length);
[   12s]         |                                         ~~~~~~~~^~~~~~
[   12s]   error: command '/usr/bin/gcc' failed with exit code 1
[   12s]   error: subprocess-exited-with-error
[   12s]=20=20=20
[   12s]   =C3=97 Building wheel for pygraphviz (pyproject.toml) did not run
successfully.
[   12s]   =E2=94=82 exit code: 1
[   12s]   =E2=95=B0=E2=94=80> See above for output.
[   12s]=20=20=20
[   12s]   note: This error originates from a subprocess, and is likely not=
 a
problem with pip.
[   12s]   full command: /usr/bin/python3.11
/usr/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_=
in_process.py
build_wheel /tmp/tmp5gaol5hi
[   12s]   cwd:
/home/abuild/rpmbuild/BUILD/python-pygraphviz-1.14-build/pygraphviz-1.14
[   12s]   Building wheel for pygraphviz (pyproject.toml): finished with st=
atus
'error'
[   12s]   ERROR: Failed building wheel for pygraphviz
[   12s] Failed to build pygraphviz
[   12s] ERROR: Failed to build one or more wheels
[   12s] error: Bad exit status from /var/tmp/rpm-tmp.suC0sM (%build)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17611477906.21e872Aa.381
Date: Wed, 22 Oct 2025 15:43:10 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252488

          Summary
          python-pygraphviz fails to build with graphviz 14.0.0

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Python

          Assignee
          python-maintainers@suse.com

          Reporter
          ana.guerrero@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Current python-pygraphviz in Factory seems to require an upd=
ate to work with
graphviz 14.0.0 (SR#1313011)

>From the build log:

[   11s]   building 'pygraphviz._graphviz' extension
[   11s]   creating build/temp.linux-x86_64-cpython-311/pygraphviz
[   11s]   gcc -O2 -Wall -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3D3
-fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables
-fstack-clash-protection -Werror=3Dreturn-type -flto=3Dauto -g -fPIC
-DSWIG_PYTHON_STRICT_BYTE_CHAR -I/usr/include/python3.11 -c
pygraphviz/graphviz_wrap.c -o
build/temp.linux-x86_64-cpython-311/pygraphviz/graphviz_wrap.o
[   11s]   pygraphviz/graphviz_wrap.c:9:9: warning:
=E2=80=98SWIG_PYTHON_STRICT_BYTE_CHAR=E2=80=99 redefined
[   11s]       9 | #define SWIG_PYTHON_STRICT_BYTE_CHAR
[   11s]         |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
[   11s]   <command-line>: note: this is the location of the previous
definition
[   12s]   pygraphviz/graphviz_wrap.c: In function =E2=80=98_wrap_gvRenderD=
ata=E2=80=99:
[   12s]   pygraphviz/graphviz_wrap.c:5480:50: error: passing argument 5 of
=E2=80=98gvRenderData=E2=80=99 from incompatible pointer type [-Wincompatib=
le-pointer-types]
[   12s]    5480 |   result =3D (int)gvRenderData(arg1,arg2,arg3,arg4,arg5);
[   12s]         |                                                  ^~~~
[   12s]         |                                                  |
[   12s]         |                                                  unsigned
int *
[   12s]   In file included from pygraphviz/graphviz_wrap.c:3024:
[   12s]   /usr/include/graphviz/gvc.h:99:49: note: expected =E2=80=98size_=
t *=E2=80=99 {aka
=E2=80=98long unsigned int *=E2=80=99} but argument is of type =E2=80=98uns=
igned int *=E2=80=99
[   12s]      99 |                          char **result, size_t *length);
[   12s]         |                                         ~~~~~~~~^~~~~~
[   12s]   error: command '/usr/bin/gcc' failed with exit code 1
[   12s]   error: subprocess-exited-with-error
[   12s]=20=20=20
[   12s]   =C3=97 Building wheel for pygraphviz (pyproject.toml) did not run
successfully.
[   12s]   =E2=94=82 exit code: 1
[   12s]   =E2=95=B0=E2=94=80> See above for output.
[   12s]=20=20=20
[   12s]   note: This error originates from a subprocess, and is likely not=
 a
problem with pip.
[   12s]   full command: /usr/bin/python3.11
/usr/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_=
in_process.py
build_wheel /tmp/tmp5gaol5hi
[   12s]   cwd:
/home/abuild/rpmbuild/BUILD/python-pygraphviz-1.14-build/pygraphviz-1.14
[   12s]   Building wheel for pygraphviz (pyproject.toml): finished with st=
atus
'error'
[   12s]   ERROR: Failed building wheel for pygraphviz
[   12s] Failed to build pygraphviz
[   12s] ERROR: Failed to build one or more wheels
[   12s] error: Bad exit status from /var/tmp/rpm-tmp.suC0sM (%build)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17611477906.21e872Aa.381--


--17611916661.8B54a.915
Date: Thu, 23 Oct 2025 03:54:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1252507

            Bug ID: 1252507
           Summary: VUL-0: CVE-2025-62707: python-pypdf: Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which ...
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/478517/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: python-maintainers-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

pypdf is a free and open-source pure-python PDF library. Prior to version
6.1.3, an attacker who uses this vulnerability can craft a PDF which leads =
to
an infinite loop. This requires parsing the content stream of a page which =
has
an inline image using the DCTDecode filter. This has been fixed in pypdf
version 6.1.3.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-62707
https://www.cve.org/CVERecord?id=3DCVE-2025-62707
https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa1=
78f8
https://github.com/py-pdf/pypdf/pull/3501
https://github.com/py-pdf/pypdf/releases/tag/6.1.3
https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17611916661.8B54a.915
Date: Thu, 23 Oct 2025 03:54:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1252507

          Summary
          VUL-0: CVE-2025-62707: python-pypdf: Prior to version 6.1.3, =
an attacker who uses this vulnerability can craft a PDF which leads to an i=
nfinite loop. This requires parsing the content stream of a page which  ...

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/478517/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          python-maintainers@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

pypdf is a free and open-source pure-python PDF library. Pri=
or to version
6.1.3, an attacker who uses this vulnerability can craft a PDF which leads =
to
an infinite loop. This requires parsing the content stream of a page which =
has
an inline image using the DCTDecode filter. This has been fixed in pypdf
version 6.1.3.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-62707
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-62707
https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3=
f4f54308b25ebbfa178f8
https://github.com/py=
-pdf/pypdf/pull/3501
https://gith=
ub.com/py-pdf/pypdf/releases/tag/6.1.3
https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc=
-m265

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17611916661.8B54a.915--