--17416864238.E94A098e.8993
Date: Tue, 11 Mar 2025 09:47:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239277

            Bug ID: 1239277
           Summary: VUL-0: CVE-2025-22868: go-containerregistry: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/442876/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22868:7.5:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1239185
  Target Milestone: ---
          Found By: ---
           Blocker: ---

An attacker can pass a malicious malformed token which causes unexpected me=
mory
to be consumed during parsing.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22868
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22868.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348366
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17416864238.E94A098e.8993
Date: Tue, 11 Mar 2025 09:47:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239277

          Summary
          VUL-0: CVE-2025-22868: go-containerregistry: golang.org/x/oau=
th2/jws: Unexpected memory consumption during token parsing in golang.org/x=
/oauth2

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442876/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22868:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N=
/I:N/A:H)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1239185

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

An attacker can pass a malicious malformed token which cause=
s unexpected memory
to be consumed during parsing.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22868
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22868.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348366

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17416864238.E94A098e.8993--


--17417116566.eFCbeff2c.10706
Date: Tue, 11 Mar 2025 16:47:36 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239353

            Bug ID: 1239353
           Summary: VUL-0: CVE-2025-22869: tailscale: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417116566.eFCbeff2c.10706
Date: Tue, 11 Mar 2025 16:47:36 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239353

          Summary
          VUL-0: CVE-2025-22869: tailscale: golang.org/x/crypto/ssh: De=
nial of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N=
/I:N/A:H)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          gabriele.sonnu@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

SSH servers which implement file transfer protocols are vuln=
erable to a denial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417116566.eFCbeff2c.10706--


--17417116662.2bcE99C6.10706
Date: Tue, 11 Mar 2025 16:47:46 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239387

            Bug ID: 1239387
           Summary: VUL-0: CVE-2025-22869: nebula: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417116662.2bcE99C6.10706
Date: Tue, 11 Mar 2025 16:47:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239387

          Summary
          VUL-0: CVE-2025-22869: nebula: golang.org/x/crypto/ssh: Denia=
l of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N=
/I:N/A:H)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          gabriele.sonnu@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

SSH servers which implement file transfer protocols are vuln=
erable to a denial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417116662.2bcE99C6.10706--


--17417117662.4eb3d8.10715
Date: Tue, 11 Mar 2025 16:49:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239417

            Bug ID: 1239417
           Summary: VUL-0: CVE-2025-22869: distrobuilder: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417117662.4eb3d8.10715
Date: Tue, 11 Mar 2025 16:49:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239417

          Summary
          VUL-0: CVE-2025-22869: distrobuilder: golang.org/x/crypto/ssh=
: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N=
/I:N/A:H)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          gabriele.sonnu@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

SSH servers which implement file transfer protocols are vuln=
erable to a denial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417117662.4eb3d8.10715--


--17417116812.6CF9B.10706
Date: Tue, 11 Mar 2025 16:48:01 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239390

            Bug ID: 1239390
           Summary: VUL-0: CVE-2025-22869: qubesome: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: jkowalczyk-at-suse.com
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417116812.6CF9B.10706
Date: Tue, 11 Mar 2025 16:48:01 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239390

          Summary
          VUL-0: CVE-2025-22869: qubesome: golang.org/x/crypto/ssh: Den=
ial of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22869:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N=
/I:N/A:H)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          jkowalczyk@suse.com

          Reporter
          gabriele.sonnu@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

SSH servers which implement file transfer protocols are vuln=
erable to a denial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417116812.6CF9B.10706--


--17417817103.79bdfAcE.12506
Date: Wed, 12 Mar 2025 12:15:10 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239494

            Bug ID: 1239494
           Summary: VUL-0: CVE-2025-22869: git-bug: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mcepl-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com, security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1239322 +++

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417817103.79bdfAcE.12506
Date: Wed, 12 Mar 2025 12:15:10 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239494

          Summary
          VUL-0: CVE-2025-22869: git-bug: golang.org/x/crypto/ssh: Deni=
al of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          mcepl@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com, security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1239322 +++

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417817103.79bdfAcE.12506--


--17417817064.067DFd9c4.12503
Date: Wed, 12 Mar 2025 12:15:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239493

            Bug ID: 1239493
           Summary: VUL-0: CVE-2025-22869: gitea-tea: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com, security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1239322 +++

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417817064.067DFd9c4.12503
Date: Wed, 12 Mar 2025 12:15:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239493

          Summary
          VUL-0: CVE-2025-22869: gitea-tea: golang.org/x/crypto/ssh: De=
nial of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com, security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1239322 +++

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417817064.067DFd9c4.12503--


body:
--17417813133.1eBA.12461
Date: Wed, 12 Mar 2025 12:08:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239488

            Bug ID: 1239488
           Summary: VUL-0: CVE-2025-22869: forgejo,forgejo-runner: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/442884/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com, security-team-at-suse.de
            Blocks: 1239322
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1239322 +++

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22869.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2348367
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17417813133.1eBA.12461
Date: Wed, 12 Mar 2025 12:08:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239488

          Summary
          VUL-0: CVE-2025-22869: forgejo,forgejo-runner: golang.org/x/c=
rypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/442884/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com, security-team@suse.de

          Blocks
          1239322

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1239322 +++

SSH servers which implement file transfer protocols are vulnerable to a den=
ial
of service attack from clients which complete the key exchange slowly, or n=
ot
at all, causing pending content to be read into memory, but never transmitt=
ed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22869
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22869.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2348367

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17417813133.1eBA.12461--

pkgs: forgejo forgejo-runner


--17418927290.911AbCec4.3495
Date: Thu, 13 Mar 2025 19:05:29 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239599

            Bug ID: 1239599
           Summary: libboost_process-devel requirements missing
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: code-at-bnavigator.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

libboost_process-devel (by default?) links to other boost interfaces, which=
 are
somehow lost since the last update:

>From apache-arrow:

[   14s]


body:
--17419608471.afE9F.5349
Date: Fri, 14 Mar 2025 14:00:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239635

            Bug ID: 1239635
           Summary: SDL3 pulls X and GTK unlike SDL2
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

```
The following 79 packages are going to be upgraded:=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  Mesa Mesa-dri Mesa-gallium Mesa-libEGL1 Mesa-libGL1 bash bash-sh bpftool =
eza
ffmpeg-4 forgejo-runner groff grub2 grub2-common grub2-i386-pc
grub2-i386-pc-extras gstreamer gstreamer-plugins-base libSDL2-2_0-0
libarchive13 libavcodec58_134=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  libavdevice58_13 libavfilter7_110 libavformat58_76 libavresample4_0
libavutil56_70 libgbm1 libglslang15 libgstallocators-1_0-0 libgstapp-1_0-0
libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstreamer-1_0-0
libgstriff-1_0-0 libgsttag-1_0-0=20=20=20=20=20
  libgstvideo-1_0-0 libmpg123-0 libncurses5 libncurses6 libncurses6-32bit
libopenblas_pthreads0 libopenmpt0 libpostproc55_9 libpython3_13-1_0
libpython3_13-1_0-x86-64-v3 libswresample3_9 libswscale5_9 libzvbi0
ncurses-utils nftables-service=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  openSUSE-build-key openSUSE-release openSUSE-release-ftp postfix
python311-yt-dlp python313 python313-base python313-base-x86-64-v3
python313-x86-64-v3 python313-yt-dlp socat syncthing system-group-hardware
system-group-kvm system-group-wheel=20=20=20=20=20=20=20=20=20=20
  system-user-bin system-user-daemon system-user-ftp system-user-lp
system-user-mail system-user-man system-user-news system-user-nobody
system-user-qemu system-user-tftp tack terminfo-base yt-dlp=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

The following product is going to be upgraded:=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  openSUSE Tumbleweed  20250311-0 -> 20250313-0=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

The following 45 NEW packages are going to be installed:=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  cups-config gtk3-data gtk3-schema gtk3-tools hicolor-icon-theme libSDL3-0
libSPIRV-Tools-2025_1_rc1 libXcomposite1 libXcursor1 libXdamage1 libXineram=
a1
libXrandr2 libXss1 libatk-1_0-0 libatk-bridge-2_0-0 libatspi0 libavc1394-0
libavcodec61 libavutil59=20
  libbluetooth3 libcamera-base0_4 libcamera0_4 libcolord2 libcups2 libdecor
libdecor-0-0 libebur128-1 libfdk-aac2 libffado2 libglibmm-2_4-1 libgtk-3-0
libiec61883-0 liblc3-1 libldac2 libpipewire-0_3-0 libswresample5 libswscale8
libva-x11-2 libvpl2=20=20=20=20=20=20=20
  libwebrtc-audio-processing-1-3 libxkbcommon0 libxml++-3_0-1
pipewire-modules-0_3 pipewire-spa-plugins-0_2 xkeyboard-config=20=20
```

see all the new packages it pulled on a headless server because of that.

rpm -e xkeyboard-config libxkbcommon0-1.8.1-1.1.x86_64
libgtk-3-0-3.24.48-4.2.x86_64  gtk3-tools libdecor=20
libdecor-0-0-0.2.2-1.4.x86_64
error: Failed dependencies:
        libxkbcommon.so.0()(64bit) is needed by (installed)
libSDL3-0-3.2.8-1.2.x86_64
        libxkbcommon.so.0(V_0.5.0)(64bit) is needed by (installed)
libSDL3-0-3.2.8-1.2.x86_64
        libdecor-0.so.0()(64bit) is needed by (installed)
libSDL3-0-3.2.8-1.2.x86_64
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17419608471.afE9F.5349
Date: Fri, 14 Mar 2025 14:00:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239635

          Summary
          SDL3 pulls X and GTK unlike SDL2

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          mrueckert@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

```
The following 79 packages are going to be upgraded:=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  Mesa Mesa-dri Mesa-gallium Mesa-libEGL1 Mesa-libGL1 bash bash-sh bpftool =
eza
ffmpeg-4 forgejo-runner groff grub2 grub2-common grub2-i386-pc
grub2-i386-pc-extras gstreamer gstreamer-plugins-base libSDL2-2_0-0
libarchive13 libavcodec58_134=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  libavdevice58_13 libavfilter7_110 libavformat58_76 libavresample4_0
libavutil56_70 libgbm1 libglslang15 libgstallocators-1_0-0 libgstapp-1_0-0
libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstreamer-1_0-0
libgstriff-1_0-0 libgsttag-1_0-0=20=20=20=20=20
  libgstvideo-1_0-0 libmpg123-0 libncurses5 libncurses6 libncurses6-32bit
libopenblas_pthreads0 libopenmpt0 libpostproc55_9 libpython3_13-1_0
libpython3_13-1_0-x86-64-v3 libswresample3_9 libswscale5_9 libzvbi0
ncurses-utils nftables-service=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  openSUSE-build-key openSUSE-release openSUSE-release-ftp postfix
python311-yt-dlp python313 python313-base python313-base-x86-64-v3
python313-x86-64-v3 python313-yt-dlp socat syncthing system-group-hardware
system-group-kvm system-group-wheel=20=20=20=20=20=20=20=20=20=20
  system-user-bin system-user-daemon system-user-ftp system-user-lp
system-user-mail system-user-man system-user-news system-user-nobody
system-user-qemu system-user-tftp tack terminfo-base yt-dlp=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

The following product is going to be upgraded:=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  openSUSE Tumbleweed  20250311-0 -> 20250313-0=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20

The following 45 NEW packages are going to be installed:=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
  cups-config gtk3-data gtk3-schema gtk3-tools hicolor-icon-theme libSDL3-0
libSPIRV-Tools-2025_1_rc1 libXcomposite1 libXcursor1 libXdamage1 libXineram=
a1
libXrandr2 libXss1 libatk-1_0-0 libatk-bridge-2_0-0 libatspi0 libavc1394-0
libavcodec61 libavutil59=20
  libbluetooth3 libcamera-base0_4 libcamera0_4 libcolord2 libcups2 libdecor
libdecor-0-0 libebur128-1 libfdk-aac2 libffado2 libglibmm-2_4-1 libgtk-3-0
libiec61883-0 liblc3-1 libldac2 libpipewire-0_3-0 libswresample5 libswscale8
libva-x11-2 libvpl2=20=20=20=20=20=20=20
  libwebrtc-audio-processing-1-3 libxkbcommon0 libxml++-3_0-1
pipewire-modules-0_3 pipewire-spa-plugins-0_2 xkeyboard-config=20=20
```

see all the new packages it pulled on a headless server because of that.

rpm -e xkeyboard-config libxkbcommon0-1.8.1-1.1.x86_64
libgtk-3-0-3.24.48-4.2.x86_64  gtk3-tools libdecor=20
libdecor-0-0-0.2.2-1.4.x86_64
error: Failed dependencies:
        libxkbcommon.so.0()(64bit) is needed by (installed)
libSDL3-0-3.2.8-1.2.x86_64
        libxkbcommon.so.0(V_0.5.0)(64bit) is needed by (installed)
libSDL3-0-3.2.8-1.2.x86_64
        libdecor-0.so.0()(64bit) is needed by (installed)
libSDL3-0-3.2.8-1.2.x86_64

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17419608471.afE9F.5349--

summary: SDL3 pulls X and GTK unlike SDL2


--17422003102.03DfCcc8.7227
Date: Mon, 17 Mar 2025 08:31:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239672

            Bug ID: 1239672
           Summary: zziplib on 32bit architectures do not support large file access
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: 32bit
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The zziplib includes a configure option for large file access on 32bit
architectures but our veresion is not configured with that.
This leads to

[  439s]
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/world/texk/=
web2c/../../../texk/web2c/luatexdir/luazip/src/luazip.c:18
3:(.text+0x21a): undefined reference to `zzip_open_ext_io64'

that is shown in zziplib-0.13.78/zzip/CMakeLists.txt

if(ZZIP_SIZEOF_OFF_T_32)
  message(STATUS "found sizeof(off_t/32)=3D${ZZIP_SIZEOF_OFF_T_32} and
sizeof(off_t/64)=3D${ZZIP_SIZEOF_OFF_T_64}")
  if(NOT ZZIP_SIZEOF_OFF_T_32 EQUAL ZZIP_SIZEOF_OFF_T_64)
    set(ZZIP_LARGEFILE_SENSITIVE 1)
    # this will turn into ZZIP_LARGEFILE_RENAME so that zzip_opendir becomes
zzip_opendir64 in the lib
    # which is needed on Linux/Solaris where the default zzip_opendir is
expected to use a 32bit off_t
    message(STATUS "system is large file sensitive - do rename symbols to
xx64")
    set(largefiles -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-D_FILE_OFFSET_BITS=3D64 -D_LARGE_FILES)
  endif()
endif()
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17422003102.03DfCcc8.7227
Date: Mon, 17 Mar 2025 08:31:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239672

          Summary
          zziplib on 32bit architectures do not support large file acce=
ss

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          32bit

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          werner@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The zziplib includes a configure option for large file acces=
s on 32bit
architectures but our veresion is not configured with that.
This leads to

[  439s]
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/world/texk/=
web2c/../../../texk/web2c/luatexdir/luazip/src/luazip.c:18
3:(.text+0x21a): undefined reference to `zzip_open_ext_io64'

that is shown in zziplib-0.13.78/zzip/CMakeLists.txt

if(ZZIP_SIZEOF_OFF_T_32)
  message(STATUS "found sizeof(off_t/32)=3D${ZZIP_SIZEOF_OFF_T_32} and
sizeof(off_t/64)=3D${ZZIP_SIZEOF_OFF_T_64}")
  if(NOT ZZIP_SIZEOF_OFF_T_32 EQUAL ZZIP_SIZEOF_OFF_T_64)
    set(ZZIP_LARGEFILE_SENSITIVE 1)
    # this will turn into ZZIP_LARGEFILE_RENAME so that zzip_opendir becomes
zzip_opendir64 in the lib
    # which is needed on Linux/Solaris where the default zzip_opendir is
expected to use a 32bit off_t
    message(STATUS "system is large file sensitive - do rename symbols=
 to
xx64")
    set(largefiles -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-D_FILE_OFFSET_BITS=3D64 -D_LARGE_FILES)
  endif()
endif()

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17422003102.03DfCcc8.7227--


--17422055000.8ee4be.7518
Date: Mon, 17 Mar 2025 09:58:20 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239679

            Bug ID: 1239679
           Summary: VUL-0: CVE-2025-2357: dcmtk: insufficient validation of input data can lead to a segmentation fault in the JPEG-LS decoder
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/445418/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: christophe-at-krop.fr
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

A vulnerability was found in DCMTK 3.6.9. It has been declared as critical.
This vulnerability affects unknown code of the component dcmjpls JPEG-LS
Decoder. The manipulation leads to memory corruption. The attack can be
initiated remotely. The exploit has been disclosed to the public and may be
used. The name of the patch is 3239a7915. It is recommended to apply a patc=
h to
fix this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-2357
https://www.cve.org/CVERecord?id=3DCVE-2025-2357
https://support.dcmtk.org/redmine/issues/1155
https://support.dcmtk.org/redmine/issues/1155?tab=3Dhistory#note-1
https://vuldb.com/?ctiid.299824
https://vuldb.com/?id.299824
https://vuldb.com/?submit.513692
https://bugzilla.redhat.com/show_bug.cgi?id=3D2352832
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17422055000.8ee4be.7518
Date: Mon, 17 Mar 2025 09:58:20 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239679

          Summary
          VUL-0: CVE-2025-2357: dcmtk: insufficient validation of input=
 data can lead to a segmentation fault in the JPEG-LS decoder

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/445418/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          christophe@krop.fr

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

A vulnerability was found in DCMTK 3.6.9. It has been declar=
ed as critical.
This vulnerability affects unknown code of the component dcmjpls JPEG-LS
Decoder. The manipulation leads to memory corruption. The attack can be
initiated remotely. The exploit has been disclosed to the public and may be
used. The name of the patch is 3239a7915. It is recommended to apply a patc=
h to
fix this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-2357
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-2357
https://support.d=
cmtk.org/redmine/issues/1155
https://support.dcmtk.org/redmine/issues/1155?tab=3Dhistory#note-1
https://vuldb.com/?ctiid.299824=

https://vuldb.com/?id.299824
https://vuldb.com/?submit.5136=
92
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2352832

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17422055000.8ee4be.7518--


--17422824060.Ce1DeD5.14069
Date: Tue, 18 Mar 2025 07:20:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239719

            Bug ID: 1239719
           Summary: gdm has a new polkit rule file: 20-gdm.rules
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

with GDM 48.0, a new polkit rule has been added as part of

https://gitlab.gnome.org/GNOME/gdm/-/commit/8ecc5d6a49c37d67e6f1370bf80f6e1=
0c0286558

[   32s] gdm.x86_64: E: polkit-file-unauthorized (Badness: 10000)
/usr/share/polkit-1/rules.d/20-gdm.rules (sha256 file digest default
filter:c752f8f6c304404e256fbd3f4bbb04d0ec42408f311454268b667597cb1c8265 she=
ll
filter:0e05583009c95385cb7ce6faa18402c87ef64dcc6413bba646ef5275b29c309b xml
filter:<failed-to-calculate>)
[   32s] Packaging polkit rules requires a review and whitelisting by the S=
USE
security
[   32s] team. If the package is intended for inclusion in any SUSE product
please open
[   32s] a bug report to request review of the package by the security team.
Please
[   32s] refer to
[   32s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   32s] more information.

As until RC that rule was not present, we have currently dropped that file =
in
GNOME:Factory in order to be able to submit GNOME 48.0 in time to Tumbleweed
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17422824060.Ce1DeD5.14069
Date: Tue, 18 Mar 2025 07:20:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239719

          Summary
          gdm has a new polkit rule file: 20-gdm.rules

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

with GDM 48.0, a new polkit rule has been added as part of

https://gitlab.gnome.org/GNOME/gdm/-/commit/8ecc5d6a4=
9c37d67e6f1370bf80f6e10c0286558

[   32s] gdm.x86_64: E: polkit-file-unauthorized (Badness: 10000)
/usr/share/polkit-1/rules.d/20-gdm.rules (sha256 file digest default
filter:c752f8f6c304404e256fbd3f4bbb04d0ec42408f311454268b667597cb1c8265 she=
ll
filter:0e05583009c95385cb7ce6faa18402c87ef64dcc6413bba646ef5275b29c309b xml
filter:<failed-to-calculate>)
[   32s] Packaging polkit rules requires a review and whitelisting by the S=
USE
security
[   32s] team. If the package is intended for inclusion in any SUSE product
please open
[   32s] a bug report to request review of the package by the security team.
Please
[   32s] refer to
[   32s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
[   32s] more information.

As until RC that rule was not present, we have currently dropped that file =
in
GNOME:Factory in order to be able to submit GNOME 48.0 in time to Tumblewee=
d

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17422824060.Ce1DeD5.14069--


--17422881000.E3b45Ffe.14387
Date: Tue, 18 Mar 2025 08:55:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239721

            Bug ID: 1239721
           Summary: Possibility to disable gpg key import/enforce gpg key into rpmdb?
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: libzypp
          Assignee: zypp-maintainers-at-suse.de
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

One problem we face since a long time with transactional-update is, that zy=
pper
cannot import new gpg keys during transactional-update's self-update and la=
ter
does not import it, since zypper thinks it is already imported (or because =
it's
in some kind of zypper cache?).

But maybe it's a transactional-update bug, that it calls zypper with
"--gpg-auto-import-keys" for self-update?

Anyways, we need a customer friendly solution here to automatically import
new/updated gpg keys from our repositories.

localhost:~ # transactional-update dup -i
Checking for newer version.
Subprocess failed. Error: Failed to import public key
[F74F09BC3FA1D6CE-67c856ee] [SUSE Package Signing Key <build-at-suse.de>]
[expires: 2029-03-05]
History:
 - Command exited with status 1.
 - error: /var/tmp/zypp.nRIcJA/pubkey-F74F09BC3FA1D6CE-1XTEUt: key 1 import
failed.
 - error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock
(Read-only file system)
Subprocess failed. Error: Failed to import public key
[FEC28EAF09D9EA69-67c857f3] [ALP Package Signing Key <build-alp-at-suse.de>]
[expires: 2029-03-05]
History:
 - Command exited with status 1.
 - error: /var/tmp/zypp.nRIcJA/pubkey-FEC28EAF09D9EA69-TvOkuU: key 1 import
failed.
 - error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock
(Read-only file system)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17422881000.E3b45Ffe.14387
Date: Tue, 18 Mar 2025 08:55:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239721

          Summary
          Possibility to disable gpg key import/enforce gpg key into rp=
mdb?

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Enhancement

          Priority
          P5 - None

          Component
          libzypp

          Assignee
          zypp-maintainers@suse.de

          Reporter
          kukuk@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

One problem we face since a long time with transactional-upd=
ate is, that zypper
cannot import new gpg keys during transactional-update's self-update and la=
ter
does not import it, since zypper thinks it is already imported (or because =
it's
in some kind of zypper cache?).

But maybe it's a transactional-update bug, that it calls zypper with
"--gpg-auto-import-keys" for self-update?

Anyways, we need a customer friendly solution here to automatically import
new/updated gpg keys from our repositories.

localhost:~ # transactional-update dup -i
Checking for newer version.
Subprocess failed. Error: Failed to import public key
[F74F09BC3FA1D6CE-67c856ee] [SUSE Package Signing Key <build@suse.de>]
[expires: 2029-03-05]
History:
 - Command exited with status 1.
 - error: /var/tmp/zypp.nRIcJA/pubkey-F74F09BC3FA1D6CE-1XTEUt: key 1 import
failed.
 - error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock
(Read-only file system)
Subprocess failed. Error: Failed to import public key
[FEC28EAF09D9EA69-67c857f3] [ALP Package Signing Key <build-alp@suse.de>]
[expires: 2029-03-05]
History:
 - Command exited with status 1.
 - error: /var/tmp/zypp.nRIcJA/pubkey-FEC28EAF09D9EA69-TvOkuU: key 1 import
failed.
 - error: can't create transaction lock on /usr/lib/sysimage/rpm/.rpm.lock
(Read-only file system)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17422881000.E3b45Ffe.14387--


--17422938924.f4E64.14651
Date: Tue, 18 Mar 2025 10:31:32 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239733

            Bug ID: 1239733
           Summary: VUL-0: CVE-2025-29786: vale: github.com/expr-lang/expr: memory exhaustion when unbounded input string is processed by Expr expression parser
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/445500/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: jkowalczyk-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com, security-team-at-suse.de
            Blocks: 1239724
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1239724 +++

Expr is an expression language and expression evaluation for Go. Prior to
version 1.17.0, if the Expr expression parser is given an unbounded input
string, it will attempt to compile the entire string and generate an Abstra=
ct
Syntax Tree (AST) node for each part of the expression. In scenarios where
input size isn=E2=80=99t limited, a malicious or inadvertent extremely larg=
e expression
can consume excessive memory as the parser builds a huge AST. This can
ultimately lead to*excessive memory usage and an Out-Of-Memory (OOM) crash =
of
the process. This issue is relatively uncommon and will only manifest when
there are no restrictions on the input size, i.e. the expression length is
allowed to grow arbitrarily large. In typical use cases where inputs are
bounded or validated, this problem would not occur. The problem has been
patched in the latest versions of the Expr library. The fix introduces
compile-time limits on the number of AST nodes and memory usage during pars=
ing,
preventing any single expression from exhausting resources. Users should
upgrade to Expr version 1.17.0 or later, as this release includes the new n=
ode
budget and memory limit safeguards. Upgrading to v1.17.0 ensures that extre=
mely
deep or large expressions are detected and safely aborted during compilatio=
n,
avoiding the OOM condition. For users who cannot immediately upgrade, the
recommended workaround is to impose an input size restriction before parsin=
g.
In practice, this means validating or limiting the length of expression str=
ings
that your application will accept. For example, set a maximum allowable num=
ber
of characters (or nodes) for any expression and reject or truncate inputs t=
hat
exceed this limit. By ensuring no unbounded-length expression is ever fed i=
nto
the parser, one can prevent the parser from constructing a pathologically l=
arge
AST and avoid potential memory exhaustion. In short, pre-validate and cap i=
nput
size as a safeguard in the absence of the patch.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-29786
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/29xxx/CVE-2025=
-29786.json
https://www.cve.org/CVERecord?id=3DCVE-2025-29786
https://github.com/expr-lang/expr/pull/762
https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2
https://bugzilla.redhat.com/show_bug.cgi?id=3D2352914
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17422938924.f4E64.14651
Date: Tue, 18 Mar 2025 10:31:32 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239733

          Summary
          VUL-0: CVE-2025-29786: vale: github.com/expr-lang/expr: memor=
y exhaustion when unbounded input string is processed by Expr expression pa=
rser

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/445500/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          jkowalczyk@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com, security-team@suse.de

          Blocks
          1239724

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1239724 +++

Expr is an expression language and expression evaluation for Go. Prior to
version 1.17.0, if the Expr expression parser is given an unbounded input
string, it will attempt to compile the entire string and generate an Abstra=
ct
Syntax Tree (AST) node for each part of the expression. In scenarios where
input size isn=E2=80=99t limited, a malicious or inadvertent extremely larg=
e expression
can consume excessive memory as the parser builds a huge AST. This can
ultimately lead to*excessive memory usage and an Out-Of-Memory (OOM) crash =
of
the process. This issue is relatively uncommon and will only manifest when
there are no restrictions on the input size, i.e. the expression length is
allowed to grow arbitrarily large. In typical use cases where inputs are
bounded or validated, this problem would not occur. The problem has been
patched in the latest versions of the Expr library. The fix introduces
compile-time limits on the number of AST nodes and memory usage during pars=
ing,
preventing any single expression from exhausting resources. Users should
upgrade to Expr version 1.17.0 or later, as this release includes the new n=
ode
budget and memory limit safeguards. Upgrading to v1.17.0 ensures that extre=
mely
deep or large expressions are detected and safely aborted during compilatio=
n,
avoiding the OOM condition. For users who cannot immediately upgrade, the
recommended workaround is to impose an input size restriction before parsin=
g.
In practice, this means validating or limiting the length of expression str=
ings
that your application will accept. For example, set a maximum allowable num=
ber
of characters (or nodes) for any expression and reject or truncate inputs t=
hat
exceed this limit. By ensuring no unbounded-length expression is ever fed i=
nto
the parser, one can prevent the parser from constructing a pathologically l=
arge
AST and avoid potential memory exhaustion. In short, pre-validate and cap i=
nput
size as a safeguard in the absence of the patch.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-29786
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/29xxx/CVE-2025-29786.json
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-29786
https://github.com/e=
xpr-lang/expr/pull/762
https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-=
9ffx-83m2
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2352914

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17422938924.f4E64.14651--


--17423319672.efbbbeBf.16792
Date: Tue, 18 Mar 2025 21:06:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239776

            Bug ID: 1239776
           Summary: [Build 20250317] openQA test fails in toolbox: run permission denied
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4932982/modules/tool
                    box/steps/51
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

Podman was switched from crun to run, now toolbox fails to launch=20

openQA test in scenario microos-Tumbleweed-DVD-x86_64-container_host@64bit-=
2G
fails in
[toolbox](https://openqa.opensuse.org/tests/4932982/modules/toolbox/steps/5=
1)

## Test suite description

## Reproducible

Fails since (at least) Build
[20250317](https://openqa.opensuse.org/tests/4931943)

## Expected result

Last good: [20250316](https://openqa.opensuse.org/tests/4928771) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dmi=
croos&flavor=3DDVD&machine=3D64bit-2G&test=3Dcontainer_host&version=3DTumbl=
eweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17423319672.efbbbeBf.16792
Date: Tue, 18 Mar 2025 21:06:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239776

          Summary
          [Build 20250317] openQA test fails in toolbox: run permission=
 denied

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4932982/modules/toolbox/ste=
ps/51

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Containers

          Assignee
          containers-bugowner@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

Podman was switched from crun to run, now toolbox fails to launch=20

openQA test in scenario microos-Tumbleweed-DVD-x86_64-container_host@64=
bit-2G
fails in
[toolbox](https://openqa.opensuse.org/tests/4932982/modules/toolbox/ste=
ps/51)

## Test suite description

## Reproducible

Fails since (at least) Build
[20250317](https://op=
enqa.opensuse.org/tests/4931943)

## Expected result

Last good: [20250316](https://openqa.opensuse.org/tests/4928771) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/lat=
est?arch=3Dx86_64&distri=3Dmicroos&flavor=3DDVD&machine=3D64bit=
-2G&test=3Dcontainer_host&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17423319672.efbbbeBf.16792--


body:
--17423666912.36d16F.17026
Date: Wed, 19 Mar 2025 06:44:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239780

            Bug ID: 1239780
           Summary: Chrome, eror code 149 or 159
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: epistemepromeneur-at-free.fr
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Chrome stable 134 from https://dl.google.com/linux/chrome/rpm/stable/x86_64

In my PC I get a Google messages web paired with my android google messages.

For two days, I can't display the conversations in google messages web.
I get a =E2=80=9CA=C3=AEe A=C3=AFe=E2=80=9D message or an =E2=80=9Cerror co=
de 149 or 159=E2=80=9D.

No problem with Firefox to access to my android google messages with Google
messages web.

I tried to uninstall chrome then delete ../config/google-chrome/ then reins=
tall
chrome.
Issue still there.

Finally, I installed with Flatpak chrome stable 133 then no problem.

Chrome 135 same problem.

There is no problem with Leap 15.6

It seems the problem is Tumbleweed environment.

See this conversation

https://forums.opensuse.org/t/chrome-support-how-stupid-it-is/183172/10
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17423666912.36d16F.17026
Date: Wed, 19 Mar 2025 06:44:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239780

          Summary
          Chrome, eror code 149 or 159

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          epistemepromeneur@free.fr

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Chrome stable 134 from https://dl.google.com/linux/chrome/rpm/stable/x=
86_64

In my PC I get a Google messages web paired with my android google messages.

For two days, I can't display the conversations in google messages web.
I get a =E2=80=9CA=C3=AEe A=C3=AFe=E2=80=9D message or an =E2=80=9Cerror co=
de 149 or 159=E2=80=9D.

No problem with Firefox to access to my android google messages with Google
messages web.

I tried to uninstall chrome then delete ../config/google-chrome/ then reins=
tall
chrome.
Issue still there.

Finally, I installed with Flatpak chrome stable 133 then no problem.

Chrome 135 same problem.

There is no problem with Leap 15.6

It seems the problem is Tumbleweed environment.

See this conversation

https://forums.opensuse.org/t/chrome-support-how-stupid-it-is/1831=
72/10

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17423666912.36d16F.17026--

summary: Chrome, eror code 149 or 159


body:
--17423707313.596E5b9.17110
Date: Wed, 19 Mar 2025 07:52:11 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239783

            Bug ID: 1239783
           Summary: support ovpn offloading
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: jslaby-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

ovpn offloading is matured enough:
https://github.com/OpenVPN/ovpn-net-next

There is version 24 submitted:
https://lore.kernel.org/all/20250318-b4-ovpn-v24-0-3ec4ab5c4a77-at-openvpn.net/

Let's incorporate this as we suggest installation of the (outdated) kmp any=
way:
$ rpm -q openvpn --recommends=20
ovpn-dco-kmp
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17423707313.596E5b9.17110
Date: Wed, 19 Mar 2025 07:52:11 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239783

          Summary
          support ovpn offloading

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          jslaby@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

ovpn offloading is matured enough:
https://github.com/Ope=
nVPN/ovpn-net-next

There is version 24 submitted:
https://lore.kernel.org/all/20250318-b4-ovpn-v24-0-3ec4ab=
5c4a77@openvpn.net/

Let's incorporate this as we suggest installation of the (outdated) kmp any=
way:
$ rpm -q openvpn --recommends=20
ovpn-dco-kmp

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17423707313.596E5b9.17110--

summary: support ovpn offloading


body:
--17423762382.C56B55.17425
Date: Wed, 19 Mar 2025 09:23:58 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1239788

            Bug ID: 1239788
           Summary: cmake4: build failure tracker bug.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: simonf.lees-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A tracker bug to track all current cmake 4 related build failure bugx. The
current status can be found in
https://build.opensuse.org/project/show/home:simotek:cmake4
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17423762382.C56B55.17425
Date: Wed, 19 Mar 2025 09:23:58 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1239788

          Summary
          cmake4: build failure tracker bug.

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          simonf.lees@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A tracker bug to track all current cmake 4 related build fai=
lure bugx. The
current status can be found in
htt=
ps://build.opensuse.org/project/show/home:simotek:cmake4

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17423762382.C56B55.17425--

summary: cmake4: build failure tracker bug.