--1547582474.C74FdcF0.15597
Date: Tue, 15 Jan 2019 20:01:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122062

            Bug ID: 1122062
           Summary: [1.14.20] Image build fails with "The flag reposd-dir requires a argument."
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: libzypp
          Assignee: zypp-maintainers-at-forge.provo.novell.com
          Reporter: dleuenberger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

zypper 1.14.20 found its way into openSUSE:Factory, where it broke all live
image builds with a log like this:

>[   70s] [ DEBUG   ]: 18:05:37 | EXEC: [mv -f /var/cache/kiwi/packages /var/cache/kiwi/packages.moved]
>[   70s] [ DEBUG   ]: 18:05:37 | EXEC: [zypper --non-interactive --pkg-cache-dir /usr/src/packages/KIWI-iso/build/image->root/var/cache/kiwi/packages --reposd-dir /usr/src/packages/KIWI-iso/build/image-root/var/cache/kiwi/zypper/repos --solv-cache-dir >/usr/src/packages/KIWI-iso/build/image-root/var/cache/kiwi/zypper/solv --cache-dir /usr/src/packages/KIWI-iso/build/image->root/var/cache/kiwi/zypper --raw-cache-dir /usr/src/packages/KIWI-iso/build/image-root/var/cache/kiwi/zypper/raw --config >/usr/src/packages/KIWI-iso/build/image-root/tmpykja6n7u --root /usr/src/packages/KIWI-iso/build/image-root addrepo --refresh --type YUM --no->keep-packages -C /repos/openSUSE:/Factory:/Live/images 9a3418140c13afbf825c7b6947f1c68c]
>[   70s] [ DEBUG   ]: 18:05:37 | EXEC: Failed with stderr: Unexpected exception.
>[   70s] The flag reposd-dir requires a argument.
>[   70s] Please file a bug report about this.
>[   70s] See http://en.opensuse.org/Zypper/Troubleshooting for instructions.
>[   70s] , stdout: (no output on stdout)
>[   70s] [ ERROR   ]: 18:05:37 | KiwiCommandError: zypper: stderr: Unexpected exception.
>[   70s] The flag reposd-dir requires a argument.
>[   70s] Please file a bug report about this.
>[   70s] See http://en.opensuse.org/Zypper/Troubleshooting for instructions.
>[   70s] , stdout: (no output on stdout)

the same issue was apparently already noticed on the submission to SLE
(https://build.suse.de/request/show/181087, declined with "breaks image
generation, please fix")

I use this bug as reference to revert zypper back to 1.14.19 in
openSUSE:Factory


--1547629329.aFb30.8098
Date: Wed, 16 Jan 2019 09:02:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122131

            Bug ID: 1122131
           Summary: VUL-1: CVE-2019-6445: An authenticated attacker can cause a NULL pointer dereference and ntpd crash
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/223020/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-6445

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can
cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to
ctl_getitem.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6445
https://dumpco.re/bugs/ntpsec-authed-npe
https://dumpco.re/blog/ntpsec-bugs
https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS


--1547629571.48740.9265
Date: Wed, 16 Jan 2019 09:06:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122132

            Bug ID: 1122132
           Summary: VUL-1: CVE-2019-6442: An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/223017/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-6442

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can
write one byte out of bounds in ntpd via a malformed config request, related to
config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in
ntp_parser.y.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6442
https://dumpco.re/bugs/ntpsec-authed-oobwrite
https://dumpco.re/blog/ntpsec-bugs
https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS


--1547629839.1C63Ff70.10418
Date: Wed, 16 Jan 2019 09:10:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122134

            Bug ID: 1122134
           Summary: VUL-1: CVE-2019-6444: A stack-based over-read was found due to  attacker's-controlled data is dereferenced by ntohl() in ntpd
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/223019/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-6444

An issue was discovered in NTPsec before 1.1.3. process_control() in
ntp_control.c has a stack-based buffer over-read because attacker-controlled
data is dereferenced by ntohl() in ntpd.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6444
https://dumpco.re/blog/ntpsec-bugs
https://dumpco.re/bugs/ntpsec-oobread2
https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS


--1547632292.1b43Fd0.23335
Date: Wed, 16 Jan 2019 09:51:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122144

            Bug ID: 1122144
           Summary: VUL-1: CVE-2019-6443: ntpsec: A stack-based buffer over-read discovered in read_sysvars in ntp_control.c in ntpd
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/223018/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-6443

An issue was discovered in NTPsec before 1.1.3. Because of a bug in
ctl_getitem,
there is a stack-based buffer over-read in read_sysvars in ntp_control.c in
ntpd.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6443
https://dumpco.re/blog/ntpsec-bugs
https://dumpco.re/bugs/ntpsec-oobread1
https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS


body:
--1547637452.03BaA1F4.3382
Date: Wed, 16 Jan 2019 11:17:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122169

            Bug ID: 1122169
           Summary: GCC 9: liblouis build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I first needed to enable tests:
https://build.opensuse.org/package/show/home:marxin:branches:GNOME:Factory/liblouis

then with:
osc build  --alternative-project=openSUSE:Factory:Staging:Gcc7

I see a lot of errors. I'm going to report that upstream:
https://github.com/liblouis/liblouis/issues/686

summary: GCC 9: liblouis build fails


--1547640622.AFB01.14340
Date: Wed, 16 Jan 2019 12:10:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122181

            Bug ID: 1122181
           Summary: [Build 20190115] openQA test fails in user_settings - warning with password complexity does not appear
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/832495/modules/user_
                    settings/steps/2
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: jeriveramoya-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario
opensuse-Tumbleweed-KDE-Live-x86_64-kde-live_installation@64bit fails in
[user_settings](https://openqa.opensuse.org/tests/832495/modules/user_settings/steps/2)

## Test suite description

## Reproducible

Fails since (at least) Build
[20181231](https://openqa.opensuse.org/tests/823083)

## Expected result

Last good: [20181224](https://openqa.opensuse.org/tests/821149) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?flavor=KDE-Live&arch=x86_64&distri=opensuse&test=kde-live_installation&machine=64bit&version=Tumbleweed)
Detected some changes regarding complexity of the password because comparing
with other builds we are typing exactly the same (I also checked locally in my
environment) Rest of the warning still there.


--1547646085.8D1e4760.18312
Date: Wed, 16 Jan 2019 13:41:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122193

            Bug ID: 1122193
           Summary: VUL-0: CVE-2018-20721: uriparser:   Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6 addresses with embedded IPv4 address
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/223044/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-20721

Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6 addresses with
embedded IPv4 address, e.g. "//[::44.1"; mitigated if passed parameter
<afterLast> points to readable memory containing a '\0' byte.

Thanks to Joergen Ibsen for the report!

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20721


--1547650244.5d6C2C4.13186
Date: Wed, 16 Jan 2019 14:50:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122204

            Bug ID: 1122204
           Summary: VUL-0: CVE-2019-2435: python-mysql-connector-python: Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python).
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/222865/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: adrian.glaubitz-at-suse.com, alarrosa-at-suse.com,
                    aplanas-at-suse.com, dmueller-at-suse.com, mcepl-at-suse.com,
                    mimi.vx-at-gmail.com, p.drouand-at-gmail.com,
                    pavlix-at-pavlix.net, petr-at-cervinka.net,
                    rjschwei-at-suse.com, sleep_walker-at-opensuse.org,
                    stephan.barth-at-suse.com, tbechtold-at-suse.com,
                    tchvatal-at-suse.com, toddrme2178-at-gmail.com
          Found By: Security Response Team
           Blocker: ---

CVE-2019-2435

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent:
Connector/Python). Supported versions that are affected are 8.0.13 and prior
and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated
attacker with network access via TLS to compromise MySQL Connectors. Successful
attacks require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in unauthorized creation,
deletion or modification access to critical data or all MySQL Connectors
accessible data as well as unauthorized access to critical data or complete
access to all MySQL Connectors accessible data.

CVSS v3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). (legend)

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-2435
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#CVE-2019-2435


--1547670170.A05cF5E1.7331
Date: Wed, 16 Jan 2019 20:22:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122242

            Bug ID: 1122242
           Summary: VUL-1: CVE-2018-20726: cacti: cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti in the Website Hostname field for Devices.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/223055/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: liedke-at-rz.uni-mannheim.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: aj-at-ajaissle.de, bitdealer-at-gmail.com,
                    joop.boonen-at-boonen.org, liedke-at-rz.uni-mannheim.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-20726

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in
Cacti before 1.2.0 due to lack of escaping of unintended characters in the
Website Hostname field for Devices.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20726
https://github.com/Cacti/cacti/issues/2213
https://github.com/Cacti/cacti/blob/develop/CHANGELOG
https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d


--1547670236.46Ac2E1.8235
Date: Wed, 16 Jan 2019 20:23:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122243

            Bug ID: 1122243
           Summary: VUL-1: CVE-2018-20725: cacti: cross-site scripting (XSS) vulnerability exists in graph_templates.php due to lack of escaping of unintended characters in the Graph Vertical Label.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/223054/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: liedke-at-rz.uni-mannheim.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: aj-at-ajaissle.de, bitdealer-at-gmail.com,
                    joop.boonen-at-boonen.org, liedke-at-rz.uni-mannheim.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-20725

A cross-site scripting (XSS) vulnerability exists in graph_templates.php in
Cacti before 1.2.0 due to lack of escaping of unintended characters in the
Graph
Vertical Label.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20725
https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d
https://github.com/Cacti/cacti/blob/develop/CHANGELOG
https://github.com/Cacti/cacti/issues/2214


--1547670304.50F2C1.8608
Date: Wed, 16 Jan 2019 20:25:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122244

            Bug ID: 1122244
           Summary: VUL-1: CVE-2018-20724: cacti: cross-site scripting (XSS) vulnerability exists in pollers.php due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/223053/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: liedke-at-rz.uni-mannheim.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: aj-at-ajaissle.de, bitdealer-at-gmail.com,
                    joop.boonen-at-boonen.org, liedke-at-rz.uni-mannheim.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-20724

A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti
before
1.2.0 due to lack of escaping of unintended characters in the Website Hostname
for Data Collectors.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20724
https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d
https://github.com/Cacti/cacti/commit/1f42478506d83d188f68ce5ff41728a7bd159f53
https://github.com/Cacti/cacti/blob/develop/CHANGELOG
https://github.com/Cacti/cacti/issues/2212


--1547670356.2B10aDa31.9011
Date: Wed, 16 Jan 2019 20:25:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122245

            Bug ID: 1122245
           Summary: VUL-1: CVE-2018-20723: cacti: cross-site scripting (XSS) vulnerability exists in color_templates.php due to lack of escaping of unintended characters in the Name field for a Color.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/223052/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: liedke-at-rz.uni-mannheim.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: aj-at-ajaissle.de, bitdealer-at-gmail.com,
                    joop.boonen-at-boonen.org, liedke-at-rz.uni-mannheim.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-20723

A cross-site scripting (XSS) vulnerability exists in color_templates.php in
Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name
field for a Color.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20723
https://github.com/Cacti/cacti/issues/2215
https://github.com/Cacti/cacti/commit/80c2a88fb2afb93f87703ba4641f9970478c102d
https://github.com/Cacti/cacti/blob/develop/CHANGELOG


--1547753586.ec0cecBd0.29448
Date: Thu, 17 Jan 2019 19:33:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122410

            Bug ID: 1122410
           Summary: lxqt-sudo does not inherit needed environment variables
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: jack.penry.12-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Applications fail to start when executed via lxqt-sudo

LXQt version: 0.13.0

For example, attempting to execute `lxqt-sudo yast2` yields:

#Begin
No protocol specified
lxqt-sudo: Stripping child environment except for: DISPLAY, LANG, LANGUAGE,
LC_ADDRESS, LC_ALL, LC_COLLATE, LC_CTYPE, LC_IDENTIFICATION, LC_MEASUREMENT,
LC_MESSAGES, LC_MONETARY, LC_NAME, LC_NUMERIC, LC_PAPER, LC_TELEPHONE, LC_TIME,
PATH, QT_PLATFORM_PLUGIN, QT_QPA_PLATFORMTHEME, WAYLAND_DISPLAY, XAUTHORITY

No protocol specified
No protocol specified
qt.qpa.xcb: could not connect to display :0
qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it
was found.
error: XDG_RUNTIME_DIR not set in the environment.
Failed to create wl_display (No such file or directory)
qt.qpa.plugin: Could not load the Qt platform plugin "wayland" in "" even
though it was found.
This application failed to start because no Qt platform plugin could be
initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen,
vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, xcb.

/usr/sbin/yast2: line 455:  3309 Aborted                 (core dumped) $y2ccbin
$Y2UI_ARGS "$@"

#End

Alternatively, executing `su -c yast2` produces expected results.


--1547754939.16abEED0.2308
Date: Thu, 17 Jan 2019 19:55:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122413

            Bug ID: 1122413
           Summary: openssl-engine-libp11 doesn't have the default pkcs11 module configured
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jejbniq-at-hansenpartnership.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The spec file of libp11 doesn't specify

BuildRequires:    p11-kit-devel

Which causes this problem.  Technically p11-kit-devel isn't required at all to
build libp11, but it is required to find the location of the default p11 kit
pkcs11 module that the engine should use.  Without this variable specified, any
attempt to use openssl-engine-libp11 via a well formed PKCS11 URI results in

jejb@jarvis:~> echo "hello"|openssl rsautl -engine pkcs11 -keyform engine
-inkey
'pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=6927071f73076f39;token=testhsm;id=%f4%ff;object=TESTKEY;type=private'
-sign -out tmp.msg
engine "pkcs11" set.
Unable to load module (null)
Unable to load module (null)
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
140645031978816:error:81065401:libp11:pkcs11_CTX_load:Unable to load PKCS#11
module:p11_load.c:79:
140645031978816:error:26096080:engine routines:ENGINE_load_private_key:failed
loading private key:crypto/engine/eng_pkey.c:78:
unable to load Private Key

Because without the default module the engine can't load any pkcs11 token
libraries.

This fix is simply to add the BuildRequires to the spec file.  I already have a
working illustration here (although this is for 0.4.9 since I'm tracking
upstream)

https://build.opensuse.org/package/show/home:jejb1:Tumbleweed/libp11


--1547797257.aa13CE0.32342
Date: Fri, 18 Jan 2019 07:40:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122455

            Bug ID: 1122455
           Summary: transactional-update and rw-root-fs: error message during update
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: iforster-at-suse.com
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

We still support a read-write root filesystem with transactional-update, but on
this, I get the following errors:

2019-01-18 01:51 transactional-update 2.11 started
2019-01-18 01:51 Options: cleanup dup reboot
2019-01-18 01:51 Separate /var detected.
2019-01-18 01:51 Adding cleanup algorithm to snapshot #274
grep: /.snapshots/*/snapshot/etc/fstab.sys: No such file or directory
2019-01-18 01:51 Deleting unused overlay /var/lib/overlay/[0-9]*
grep: /.snapshots/*/snapshot/etc/fstab.sys: No such file or directory
2019-01-18 01:51 Deleting unused overlay /var/lib/overlay
2019-01-18 01:51 zypper: nothing to update
2019-01-18 01:51 transactional-update finished


--1547840381.15c3bCb0.27253
Date: Fri, 18 Jan 2019 19:39:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122535

            Bug ID: 1122535
           Summary: VUL-1: CVE-2009-4112: cacti: Privilege escalation under certain conditions
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/41118/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: liedke-at-rz.uni-mannheim.de
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

From https://github.com/Cacti/cacti/issues/1072
" CVE-2009-4112 still exists (after 8 years) #1072 "

This re-occurrence is now about creating new data input methods rather than
modifying existing ones. Mitigation in upstream 1.2.0.


--1547863001.CB5b24.29381
Date: Sat, 19 Jan 2019 01:56:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122554

            Bug ID: 1122554
           Summary: Recent LEAP 15.0 kernels do not boot past "fb0: switching to inteldrmfb from EFI VGA"
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: David@WalkerStreet.info
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 794931
  --> http://bugzilla.suse.com/attachment.cgi?id=794931&action=edit
Hwinfo for Fitlet2

The initial install of LEAP 15.0 on a new Fitlet2 system with an "Intel Celeron
N3350/Pentium N4200/Atom E3900 Series Integrated Graphics Controller" was
successful, but after updating to 4.12.14-lp150.12.45-default, the system would
no longer boot.  I believe the last message on the console was "fb0: switching
to inteldrmfb from EFI VGA," although the screen blanked quickly, so I'm not
positive.

I retreated to the original LEAP 15.0 distribution kernel, added the
kernel:stable repository, and installed 4.20.2-3.g036c5c2-default.  Things seem
to be OK now.

I've attached hwinfo.  Let me know if there's more you'd like.


body:
--1548010929.bffE381.19123
Date: Sun, 20 Jan 2019 19:02:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122572

            Bug ID: 1122572
           Summary: provide quasselcore for quasseldroid
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-15-SP1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: dmueller-at-suse.com
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

quasseldroid needs quasselcore 0.13.0 or newer. we should provide the update.

summary: provide quasselcore for quasseldroid


body:
--1548090403.1CFf660.24549
Date: Mon, 21 Jan 2019 17:06:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122683

            Bug ID: 1122683
           Summary: osc: deprecate insecure APIs
    Classification: Internal Novell Products
           Product: openSUSE Build Service
           Version: master
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: osc
          Assignee: adrian-at-suse.com
          Reporter: malte.kraus-at-suse.com
        QA Contact: adrian-at-suse.com
          Found By: ---
           Blocker: ---

From bnc#1119444:

> > The OSC client has some vulnerable code in it, that it doesn't use itself but provides as a library to plugins. In one case there's even a comment explicitly marking this as insecure, but are not removed due to compatibility concerns. If not breaking backwards compatibility under any circumstances is that important, I recommend adding deprecation warnings (https://docs.python.org/2.6/library/warnings.html#temporarily-suppressing-warnings) to move plugins over to secure APIs.
>
> Can you create a dedicated request for this?

Specifically, the 'unpack_srcrpm' function has such a warning as a comment.

Also, 'Ar.saveTo', 'CpioRead.copyin' can be made to store files in arbitrary
locations if the archive they parsed contain a filename starting with a "/".

summary: osc: deprecate insecure APIs


--1548175837.0Ddcc0.12482
Date: Tue, 22 Jan 2019 16:50:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122792

            Bug ID: 1122792
           Summary: GraphicsMagick: removal of ghostscript support
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1117336
          Found By: ---
           Blocker: ---

In the security team we are currently trying to reduce the attack surface of
our products regarding vulnerabilities in ghostscript. For some more context
please refer to bug 1117336.

To summarize: ghostscript is considered broken beyond repair regarding
processing of untrusted input. However, ghostscript usage is spread across the
distribution as well via its binaries like the `gs` program or `ps2<X>`
programs as well as its libraries `libgs`, `libX` and its wrapper libraries
`libspectre`.

We attempt to at least remove the support for postscript input processing from
widespread packages that provide such features. While in ImageMagick the issue
can be addressed during runtime via the `policy.xml` configuration file,
GraphicsMagick does not offer such an option. Instead upstream has removed
their ghostscript library support completely via upstream mercurial commit
15818:77db7f28c7b3. The support can be reenabled, however, by passing custom
compiler and linker flags like `CPPFLAGS=-DHasGS LIBS=-lgs`.

The current GraphicsMagick devel and openSUSE:Factory packages already package
this changed upstream code and no longer support ghostscript. I opened this bug
to ask you / discuss the following:

- The ghostscript feature should not be reenabled via the compiler and linker
flags. Maybe you can somehow add a suitable comment to the spec file or some
other security measure to prevent this from happening.
- It might make sense to backport this removal of ghostscript support to Leap
15.1. I don't know what the plans for 15.1 are for GraphicsMagick but the
backport of this change shouldn't be too difficult.
- Maybe we can communicate this feature removal more prominently to users of
the package (extra changelog entry, ..., ?)

Thank you!


body:
--1548176694.11EDba1D6.15014
Date: Tue, 22 Jan 2019 17:04:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122794

            Bug ID: 1122794
           Summary: evince: removal of ghostscript support
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1117336
          Found By: ---
           Blocker: ---

In the security team we are currently trying to reduce the attack surface of
our products regarding vulnerabilities in ghostscript. For some more context
please refer to bug 1117336.

To summarize: ghostscript is considered broken beyond repair regarding
processing of untrusted input. However, ghostscript usage is spread across the
distribution as well via its binaries like the `gs` program or `ps2<X>`
programs as well as its libraries `libgs`, `libX` and its wrapper libraries
`libspectre`.

We attempt to at least remove the support for postscript input processing from
widespread packages that provide such features. evince offers support for
processing postscript, if compiled in. Upstream decided in commit
1621cacf75ebff4ab4ab0fa6855977a2d8da0ac6 to disable postscript support by
default. evince is part of a chain of software components that enabled a
possible remote code execution exploit that involves downloading a postscript
file that is being thumbnailed by nautilus via evince, resulting in the
triggering of the exploit.

In the evince devel and Factory packages the new upstream version with disabled
postscript support is already in place, however now `--enable-ps` is passed
explicitly in the spec files to reenable the support. I opened this bug to ask
for the following:

- no longer pass --enable-ps in the devel and Factory packages
- possibly also backport the above commit to openSUSE:Leap:15.1 to disable
postscript there, too
- try to make sure the --enable-ps switch in not passed again in the future by
way of an appropriate comment in the spec file or other suitable means
- maybe inform end users more prominently about this change (e.g. via a
changelog entry)

A fallback for users who really want to view postscript files can be dedicated
software like ghostview.

summary: evince: removal of ghostscript support


body:
--1548177625.3B3fc1f30.21276
Date: Tue, 22 Jan 2019 17:20:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1122797

            Bug ID: 1122797
           Summary: okular: removal of ghostscript support
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: lbeltrame-at-kde.org
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1117336
          Found By: ---
           Blocker: ---

In the security team we are currently trying to reduce the attack surface of
our products regarding vulnerabilities in ghostscript. For some more context
please refer to bug 1117336.

To summarize: ghostscript is considered broken beyond repair regarding
processing of untrusted input. However, ghostscript usage is spread across the
distribution as well via its binaries like the `gs` program or `ps2<X>`
programs as well as its libraries `libgs`, `libX` and its wrapper libraries
`libspectre`.

We attempt to at least remove the support for postscript input processing from
widespread packages that provide such features. okular is one of those
packages. On the Gnome side 'evince' was part of an attack vector to facilitate
remote code execution with postscript/ghostscript being involved. As a reaction
to this 'evince' upstream disabled postscript support by default. In okular
upstream nothing like this seems to have happened. However, we as a
distribution can still decide to disable the support for this.

I opened this bug to ask for the following:

- disable the postscript support in okular for Factory/Tumbleweed. This should
be possible to achieve by removing the 'BuildRequires: libspectre-devel' from
the spec file.
- it might make sense to backport this change also to the openSUSE:Leap:15.1
upcoming release
- maybe inform end users about this change (e.g. via a prominent changelog
entry)

A fallback for users who really want to view postscript files can be dedicated
software like ghostview.

summary: okular: removal of ghostscript support


--1548229172.E876d0.11014
Date: Wed, 23 Jan 2019 07:39:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122841

            Bug ID: 1122841
           Summary: VUL-0: CVE-2019-3817: libcomps: use after free when merging two objmrtrees
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/223533/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: ngompa13-at-gmail.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

There is a use-after-free in libcomps library in
comps_objmradix.c:comps_objmrtree_unite() function. When two ObjMRTrees are
merged, pair variable may be freed and accessed again at the next iteration. An
attacker who is able to craft a malicious comps XML file may use this flaw to
crash the application or potentially execute code.

Upstream issue:
https://github.com/rpm-software-management/libcomps/issues/41

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1668005
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3817


--1548235829.d71a0.17006
Date: Wed, 23 Jan 2019 09:30:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122855

            Bug ID: 1122855
           Summary: fpc fails to build on obs-arm-7 worker only
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

fpc fails to build on obs-arm-7 (ThunderX2 machine) worker but succeeds on
obs-arm-4 (ThunderX1 machine).
The error is:
[  468s] Searching /home/abuild/rpmbuild/BUILD/fpcbStart compiling package a52
for target aarch64-linux.
[  468s]        Compiling a52/src/a52.pas
[  468s] The installer encountered the following error:
[  468s] Invalid floating point operation
[  468s] uild/fpcsrc/packages/ide/
[  468s] make[1]: *** [Makefile:1717: smart] Error 1
[  468s] make[1]: Leaving directory
'/home/abuild/rpmbuild/BUILD/fpcbuild/fpcsrc/packages'
[  468s] make: *** [Makefile:2651: packages_smart] Error 2


--1548251644.06Ac0.6955
Date: Wed, 23 Jan 2019 13:54:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1122892

            Bug ID: 1122892
           Summary: sysconfig variable for postgresql's initdb
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: SLES 12
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: joerg-at-bec.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The systemd helper script for PostgreSQL runs initdb with some pretty standard
options. It would be nice to allow setting extra flags easily, e.g. to enable
the checksum option. Putting it in /etc/sysconfig/postgresql interacts better
with the documented work flow for running pg_update and also serves as easily
available documentation, i.e.:
- introduce POSTGRES_INITDB_OPTIONS in /etc/sysconfig/postgresql
- pass ${PSOTGRES_INITDB_OPTIONS} to initdb in /usr/lib/postgresql-init


--1548343978.7fA7322a0.22509
Date: Thu, 24 Jan 2019 15:32:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123064

            Bug ID: 1123064
           Summary: devel:languages:python/python-six: shellscript %pretrans breaks initial chroot setup
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: pth-at-suse.com
          Reporter: ngompa13-at-gmail.com
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
                CC: ngompa13-at-gmail.com
          Found By: ---
           Blocker: ---

The change python-six done to resolve bug #1057496 broke my ability to build
openSUSE Tumbleweed chroots using Mock. Moreover, it broke the ability for
Fedora COPR to build openSUSE Tumbleweed packages.

The error I get is:

> Running transaction check
> Error: transaction check vs depsolve:
> /bin/sh is needed by python3-six-1.12.0-1.1.noarch

This is because the %pretrans scriptlet causes a "Requires(pretrans): /bin/sh"
dependency to be emitted. There's no way that "/bin/sh" is going to be
satisfied when nothing exists yet.

This works fine in OBS because the way chroots are constructed in the build
service causes it to skip stuff like this automatically, so it isn't impaired.

I looked around the openSUSE wiki to see if there was something like the Fedora
packaging guideline about directory replacement[1], but there doesn't seem to
be.

Can this please be fixed so that Mock/COPR builds are unbroken?

[1]: https://fedoraproject.org/wiki/Packaging:Directory_Replacement


body:
--1548406750.836D0.12721
Date: Fri, 25 Jan 2019 08:59:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123131

            Bug ID: 1123131
           Summary: LibreOffice:Factory/libreoffice: Bug
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: tchvatal-at-suse.com
          Reporter: cornelis-at-solcon.nl
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

The new kde5 and qt5 vcl plugins are not build with 6.2.0.3. See for example
the buildlog:

configure: VCLplugs to be built: gtk gtk3 gtk3_kde5

See also release notes:

> Two new VCL plugins (qt5 and kde5) have been implemented (with the KDE5 plugin extending the Qt5 one) to provide integration into KDE Plasma 5 and other Qt5-based desktop environments, mainly implemented by Katar�na Behrens (CIB) and Jan-Marek Glogowski (City of Munich).

Looking at the spec file first kde5 is enabled, but later in the file kde5 is
disabled again. I think qt5 also need to be enabled for kde5 to work.

summary: LibreOffice:Factory/libreoffice: Bug


body:
--1548586179.b5CD0.32733
Date: Sun, 27 Jan 2019 10:49:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123247

            Bug ID: 1123247
           Summary: Gajim requires nbxmpp version that's not available
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: opensuse-at-trummer.xyz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Most likely the same issue as
https://bugzilla.opensuse.org/show_bug.cgi?id=1072573

Output when trying to start Gajim:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 581,
in _build_master
    ws.require(__requires__)
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 898,
in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 789,
in resolve
    raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (nbxmpp 0.6.8
(/usr/lib/python3.6/site-packages), Requirement.parse('nbxmpp<0.7.0,>=0.6.9'),
{'gajim'})

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/gajim", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3126,
in <module>
    @_call_aside
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3110,
in _call_aside
    f(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3139,
in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 583,
in _build_master
    return cls._build_from_requirements(__requires__)
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 596,
in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 784,
in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'nbxmpp<0.7.0,>=0.6.9' distribution was
not found and is required by gajim

OS: openSUSE Tumbleweed 20190124

pkgs: gajim python-nbxmpp


--1548661970.DCb50.6925
Date: Mon, 28 Jan 2019 07:52:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123271

            Bug ID: 1123271
           Summary: VUL-0: CVE-2019-6798: phpMyAdmin: SQL injection through malformed username
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: chris-at-computersalat.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

https://www.phpmyadmin.net/security/PMASA-2019-2/

Announcement-ID: PMASA-2019-2
Date: 2019-01-22
Summary: SQL injection in Designer feature
Description: A vulnerability was reported where a specially crafted username
can be used to trigger an SQL injection attack through the designer feature.
Severity: We consider this vulnerability to be serious.

Affected Versions: phpMyAdmin versions from 4.5.0 through 4.8.4 are affected
Solution: Upgrade to phpMyAdmin 4.8.5 or newer or apply patch listed below.

https://github.com/phpmyadmin/phpmyadmin/commit/4.8
https://github.com/phpmyadmin/phpmyadmin/commit/469934cf7d3bd19a839eb78670590f7511399435


--1548661974.cd4740.8555
Date: Mon, 28 Jan 2019 07:52:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123272

            Bug ID: 1123272
           Summary: VUL-0: CVE-2019-6799: phpMyAdmin: Arbitrary file read vulnerability (PMASA-2019-1)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: chris-at-computersalat.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

https://www.phpmyadmin.net/security/PMASA-2019-1/

Announcement-ID: PMASA-2019-1

Date: 2019-01-21
Summary: Arbitrary file read vulnerability
Description: When AllowArbitraryServer configuration set to true, with the use
of a rogue MySQL server, an attacker can read any file on the server that the
web server's user can access.

phpMyadmin attempts to block the use of LOAD DATA INFILE, but due to a bug in
PHP, this check is not honored. Additionally, when using the 'mysql' extension,
mysql.allow_local_infile is enabled by default. Both of these conditions allow
the attack to occur.
Severity: We consider this vulnerability to be critical.

Mitigation factor: This attack can be mitigated by setting the
`AllowArbitraryServer` configuration directive to false (which is the default
value).

Affected Versions: phpMyAdmin versions from at least 4.0 through 4.8.4 are
affected

https://github.com/phpmyadmin/phpmyadmin/commit/aeac90623e525057a7672ab3d98154b5c57c15ec
https://github.com/phpmyadmin/phpmyadmin/commit/c5e01f84ad48c5c626001cb92d7a95500920a900


--1548668708.4ea10d3.32681
Date: Mon, 28 Jan 2019 09:45:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123311

            Bug ID: 1123311
           Summary: pcp build requires openSUSE-release sounds strange and wrong
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: ddiss-at-suse.com
          Reporter: mlin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: lnussel-at-suse.com
          Found By: ---
           Blocker: ---

Hi David, pcp now build requires openSUSE-release(for SLE its sles-release),
what is the purpose for that? building with the release package sounds strange,
is it must to have?

[1] pcp submission: https://build.opensuse.org/request/show/668243


--1548671306.aeB3C16c3.26634
Date: Mon, 28 Jan 2019 10:28:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123328

            Bug ID: 1123328
           Summary: obs-arm-7 hangs on umount/mount (obs worker kvm builds) with kernel >= 4.19
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

when obs-arm-7 (Cavium ThunderX CN99xx) builds with kernel >= 4.19, the initial
umount/mount of filesystems is hanging:

# ps -elf | grep umou
4 D root      60909      1  0  80   0 -   995 blk_mq Jan22 ?        00:00:00
umount /var/cache/obs/worker/root_3/.mount
0 D root     102921 102894  0  80   0 -   998 blkdev 10:11 pts/20   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_5/root
/var/cache/obs/worker/root_5/.mount
0 D root     102949 102922  0  80   0 -   998 blkdev 10:11 pts/23   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_8/root
/var/cache/obs/worker/root_8/.mount
0 D root     102977 102950  0  80   0 -   998 blkdev 10:11 pts/22   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_7/root
/var/cache/obs/worker/root_7/.mount
0 D root     103005 102978  0  80   0 -   998 blkdev 10:11 pts/25   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_10/root
/var/cache/obs/worker/root_10/.mount
0 D root     103063 103036  0  80   0 -   998 blkdev 10:12 pts/24   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_9/root
/var/cache/obs/worker/root_9/.mount
0 D root     103137 103110  0  80   0 -   998 blkdev 10:13 pts/17   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_2/root
/var/cache/obs/worker/root_2/.mount
0 D root     103253 103217  0  80   0 -   998 blkdev 10:14 pts/26   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_11/root
/var/cache/obs/worker/root_11/.mount
0 D root     103273 103226  0  80   0 -   998 blkdev 10:14 pts/27   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_12/root
/var/cache/obs/worker/root_12/.mount
0 D root     103324 103292  0  80   0 -   998 blkdev 10:14 pts/30   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_15/root
/var/cache/obs/worker/root_15/.mount
0 D root     103875 103843  0  80   0 -   998 blkdev 10:21 pts/16   00:00:00
mount -o noatime,loop /var/cache/obs/worker/root_1/root
/var/cache/obs/worker/root_1/.mount

sysrq-W gives:

[1213689.321930]   task                        PC stack   pid father
[1213689.325022] umount          D    0 60909      1 0x00000009
[1213689.325027] Call trace:
[1213689.325035]  __switch_to+0x9c/0xd8
[1213689.325042]  __schedule+0x2a0/0x888
[1213689.325045]  schedule+0x30/0x88
[1213689.325050]  blk_mq_freeze_queue_wait+0x54/0xa0
[1213689.325053]  blk_freeze_queue+0x30/0x58
[1213689.325055]  blk_mq_freeze_queue+0x20/0x30
[1213689.325064]  loop_clr_fd+0x4c/0x288 [loop]
[1213689.325067]  lo_release+0xa4/0xc8 [loop]
[1213689.325072]  __blkdev_put+0x22c/0x260
[1213689.325074]  blkdev_put+0xe4/0x118
[1213689.325079]  kill_block_super+0x44/0x58
[1213689.325082]  deactivate_locked_super+0x50/0x90
[1213689.325084]  deactivate_super+0x74/0x80
[1213689.325087]  cleanup_mnt+0x44/0x88
[1213689.325089]  __cleanup_mnt+0x20/0x30
[1213689.325093]  task_work_run+0xb8/0xe8
[1213689.325096]  do_notify_resume+0x2f4/0x390
[1213689.325097]  work_pending+0x8/0x14
[1213689.325101] mount           D    0 61620      1 0x00000001
[1213689.325104] Call trace:
[1213689.325106]  __switch_to+0x9c/0xd8
[1213689.325109]  __schedule+0x2a0/0x888
[1213689.325111]  schedule+0x30/0x88
[1213689.325113]  schedule_preempt_disabled+0x14/0x20
[1213689.325115]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325117]  __mutex_lock_slowpath+0x24/0x30
[1213689.325120]  mutex_lock+0x48/0x50
[1213689.325122]  __blkdev_get+0x70/0x488
[1213689.325124]  blkdev_get+0x10c/0x368
[1213689.325125]  blkdev_open+0x9c/0xb0
[1213689.325128]  do_dentry_open+0x11c/0x340
[1213689.325130]  vfs_open+0x38/0x48
[1213689.325133]  do_last+0x224/0x830
[1213689.325135]  path_openat+0x68/0x238
[1213689.325137]  do_filp_open+0x70/0xd0
[1213689.325139]  do_sys_open+0x15c/0x1e8
[1213689.325141]  __arm64_sys_openat+0x2c/0x38
[1213689.325145]  el0_svc_common+0x98/0x100
[1213689.325147]  el0_svc_handler+0x38/0x78
[1213689.325149]  el0_svc+0x8/0xc
[1213689.325153] mount           D    0 62347      1 0x00000001
[1213689.325155] Call trace:
[1213689.325157]  __switch_to+0x9c/0xd8
[1213689.325160]  __schedule+0x2a0/0x888
[1213689.325162]  schedule+0x30/0x88
[1213689.325164]  schedule_preempt_disabled+0x14/0x20
[1213689.325166]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325168]  __mutex_lock_slowpath+0x24/0x30
[1213689.325170]  mutex_lock+0x48/0x50
[1213689.325172]  __blkdev_get+0x70/0x488
[1213689.325174]  blkdev_get+0x10c/0x368
[1213689.325176]  blkdev_open+0x9c/0xb0
[1213689.325178]  do_dentry_open+0x11c/0x340
[1213689.325179]  vfs_open+0x38/0x48
[1213689.325182]  do_last+0x224/0x830
[1213689.325184]  path_openat+0x68/0x238
[1213689.325186]  do_filp_open+0x70/0xd0
[1213689.325187]  do_sys_open+0x15c/0x1e8
[1213689.325189]  __arm64_sys_openat+0x2c/0x38
[1213689.325191]  el0_svc_common+0x98/0x100
[1213689.325193]  el0_svc_handler+0x38/0x78
[1213689.325195]  el0_svc+0x8/0xc
[1213689.325199] mount           D    0 62405      1 0x00000001
[1213689.325201] Call trace:
[1213689.325203]  __switch_to+0x9c/0xd8
[1213689.325205]  __schedule+0x2a0/0x888
[1213689.325207]  schedule+0x30/0x88
[1213689.325209]  schedule_preempt_disabled+0x14/0x20
[1213689.325211]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325214]  __mutex_lock_slowpath+0x24/0x30
[1213689.325216]  mutex_lock+0x48/0x50
[1213689.325218]  __blkdev_get+0x70/0x488
[1213689.325220]  blkdev_get+0x10c/0x368
[1213689.325222]  blkdev_open+0x9c/0xb0
[1213689.325223]  do_dentry_open+0x11c/0x340
[1213689.325225]  vfs_open+0x38/0x48
[1213689.325227]  do_last+0x224/0x830
[1213689.325229]  path_openat+0x68/0x238
[1213689.325231]  do_filp_open+0x70/0xd0
[1213689.325233]  do_sys_open+0x15c/0x1e8
[1213689.325234]  __arm64_sys_openat+0x2c/0x38
[1213689.325237]  el0_svc_common+0x98/0x100
[1213689.325239]  el0_svc_handler+0x38/0x78
[1213689.325240]  el0_svc+0x8/0xc
[1213689.325244] mount           D    0 62568      1 0x00000001
[1213689.325246] Call trace:
[1213689.325248]  __switch_to+0x9c/0xd8
[1213689.325250]  __schedule+0x2a0/0x888
[1213689.325252]  schedule+0x30/0x88
[1213689.325254]  schedule_preempt_disabled+0x14/0x20
[1213689.325256]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325258]  __mutex_lock_slowpath+0x24/0x30
[1213689.325260]  mutex_lock+0x48/0x50
[1213689.325262]  __blkdev_get+0x70/0x488
[1213689.325264]  blkdev_get+0x10c/0x368
[1213689.325266]  blkdev_open+0x9c/0xb0
[1213689.325267]  do_dentry_open+0x11c/0x340
[1213689.325269]  vfs_open+0x38/0x48
[1213689.325271]  do_last+0x224/0x830
[1213689.325273]  path_openat+0x68/0x238
[1213689.325275]  do_filp_open+0x70/0xd0
[1213689.325277]  do_sys_open+0x15c/0x1e8
[1213689.325279]  __arm64_sys_openat+0x2c/0x38
[1213689.325281]  el0_svc_common+0x98/0x100
[1213689.325283]  el0_svc_handler+0x38/0x78
[1213689.325284]  el0_svc+0x8/0xc
[1213689.325288] mount           D    0 62723      1 0x00000001
[1213689.325290] Call trace:
[1213689.325292]  __switch_to+0x9c/0xd8
[1213689.325294]  __schedule+0x2a0/0x888
[1213689.325296]  schedule+0x30/0x88
[1213689.325298]  schedule_preempt_disabled+0x14/0x20
[1213689.325300]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325302]  __mutex_lock_slowpath+0x24/0x30
[1213689.325304]  mutex_lock+0x48/0x50
[1213689.325306]  __blkdev_get+0x70/0x488
[1213689.325308]  blkdev_get+0x10c/0x368
[1213689.325310]  blkdev_open+0x9c/0xb0
[1213689.325312]  do_dentry_open+0x11c/0x340
[1213689.325313]  vfs_open+0x38/0x48
[1213689.325315]  do_last+0x224/0x830
[1213689.325317]  path_openat+0x68/0x238
[1213689.325319]  do_filp_open+0x70/0xd0
[1213689.325321]  do_sys_open+0x15c/0x1e8
[1213689.325323]  __arm64_sys_openat+0x2c/0x38
[1213689.325325]  el0_svc_common+0x98/0x100
[1213689.325327]  el0_svc_handler+0x38/0x78
[1213689.325328]  el0_svc+0x8/0xc

[1213689.325333] mount           D    0 66786      1 0x00000001
[1213689.325335] Call trace:
[1213689.325337]  __switch_to+0x9c/0xd8
[1213689.325340]  __schedule+0x2a0/0x888
[1213689.325342]  schedule+0x30/0x88
[1213689.325344]  schedule_preempt_disabled+0x14/0x20
[1213689.325346]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325348]  __mutex_lock_slowpath+0x24/0x30
[1213689.325350]  mutex_lock+0x48/0x50
[1213689.325352]  __blkdev_get+0x70/0x488
[1213689.325354]  blkdev_get+0x10c/0x368
[1213689.325356]  blkdev_open+0x9c/0xb0
[1213689.325358]  do_dentry_open+0x11c/0x340
[1213689.325360]  vfs_open+0x38/0x48
[1213689.325362]  do_last+0x224/0x830
[1213689.325364]  path_openat+0x68/0x238
[1213689.325366]  do_filp_open+0x70/0xd0
[1213689.325368]  do_sys_open+0x15c/0x1e8
[1213689.325370]  __arm64_sys_openat+0x2c/0x38
[1213689.325372]  el0_svc_common+0x98/0x100
[1213689.325374]  el0_svc_handler+0x38/0x78
[1213689.325375]  el0_svc+0x8/0xc
[1213689.325379] mount           D    0 72349      1 0x00000001
[1213689.325381] Call trace:
[1213689.325383]  __switch_to+0x9c/0xd8
[1213689.325386]  __schedule+0x2a0/0x888
[1213689.325388]  schedule+0x30/0x88
[1213689.325390]  schedule_preempt_disabled+0x14/0x20
[1213689.325392]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325394]  __mutex_lock_slowpath+0x24/0x30
[1213689.325396]  mutex_lock+0x48/0x50
[1213689.325399]  __blkdev_get+0x70/0x488
[1213689.325400]  blkdev_get+0x10c/0x368
[1213689.325402]  blkdev_open+0x9c/0xb0
[1213689.325404]  do_dentry_open+0x11c/0x340
[1213689.325406]  vfs_open+0x38/0x48
[1213689.325408]  do_last+0x224/0x830
[1213689.325410]  path_openat+0x68/0x238
[1213689.325412]  do_filp_open+0x70/0xd0
[1213689.325414]  do_sys_open+0x15c/0x1e8
[1213689.325416]  __arm64_sys_openat+0x2c/0x38
[1213689.325418]  el0_svc_common+0x98/0x100
[1213689.325420]  el0_svc_handler+0x38/0x78
[1213689.325422]  el0_svc+0x8/0xc
[1213689.325425] mount           D    0 75917      1 0x00000001
[1213689.325427] Call trace:
[1213689.325429]  __switch_to+0x9c/0xd8
[1213689.325432]  __schedule+0x2a0/0x888
[1213689.325434]  schedule+0x30/0x88
[1213689.325436]  schedule_preempt_disabled+0x14/0x20
[1213689.325438]  __mutex_lock.isra.1+0x2c0/0x4b8

[1213689.325440]  __mutex_lock_slowpath+0x24/0x30
[1213689.325442]  mutex_lock+0x48/0x50
[1213689.325444]  __blkdev_get+0x70/0x488
[1213689.325446]  blkdev_get+0x10c/0x368
[1213689.325448]  blkdev_open+0x9c/0xb0
[1213689.325449]  do_dentry_open+0x11c/0x340
[1213689.325451]  vfs_open+0x38/0x48
[1213689.325453]  do_last+0x224/0x830
[1213689.325455]  path_openat+0x68/0x238
[1213689.325457]  do_filp_open+0x70/0xd0
[1213689.325459]  do_sys_open+0x15c/0x1e8
[1213689.325461]  __arm64_sys_openat+0x2c/0x38
[1213689.325463]  el0_svc_common+0x98/0x100
[1213689.325465]  el0_svc_handler+0x38/0x78
[1213689.325467]  el0_svc+0x8/0xc
[1213689.325471] mount           D    0 77793      1 0x00000001
[1213689.325472] Call trace:
[1213689.325474]  __switch_to+0x9c/0xd8
[1213689.325477]  __schedule+0x2a0/0x888
[1213689.325479]  schedule+0x30/0x88
[1213689.325481]  schedule_preempt_disabled+0x14/0x20
[1213689.325483]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325485]  __mutex_lock_slowpath+0x24/0x30
[1213689.325487]  mutex_lock+0x48/0x50
[1213689.325489]  __blkdev_get+0x70/0x488
[1213689.325491]  blkdev_get+0x10c/0x368
[1213689.325493]  blkdev_open+0x9c/0xb0
[1213689.325494]  do_dentry_open+0x11c/0x340
[1213689.325496]  vfs_open+0x38/0x48
[1213689.325498]  do_last+0x224/0x830
[1213689.325500]  path_openat+0x68/0x238
[1213689.325502]  do_filp_open+0x70/0xd0
[1213689.325504]  do_sys_open+0x15c/0x1e8
[1213689.325505]  __arm64_sys_openat+0x2c/0x38
[1213689.325507]  el0_svc_common+0x98/0x100
[1213689.325509]  el0_svc_handler+0x38/0x78
[1213689.325511]  el0_svc+0x8/0xc
[1213689.325514] mount           D    0 79041      1 0x00000001
[1213689.325516] Call trace:
[1213689.325518]  __switch_to+0x9c/0xd8
[1213689.325521]  __schedule+0x2a0/0x888
[1213689.325523]  schedule+0x30/0x88
[1213689.325525]  schedule_preempt_disabled+0x14/0x20
[1213689.325527]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325529]  __mutex_lock_slowpath+0x24/0x30
[1213689.325531]  mutex_lock+0x48/0x50
[1213689.325533]  __blkdev_get+0x70/0x488
[1213689.325535]  blkdev_get+0x10c/0x368
[1213689.325536]  blkdev_open+0x9c/0xb0
[1213689.325538]  do_dentry_open+0x11c/0x340
[1213689.325540]  vfs_open+0x38/0x48
[1213689.325542]  do_last+0x224/0x830
[1213689.325544]  path_openat+0x68/0x238
[1213689.325546]  do_filp_open+0x70/0xd0
[1213689.325547]  do_sys_open+0x15c/0x1e8
[1213689.325549]  __arm64_sys_openat+0x2c/0x38
[1213689.325551]  el0_svc_common+0x98/0x100
[1213689.325553]  el0_svc_handler+0x38/0x78
[1213689.325555]  el0_svc+0x8/0xc
[1213689.325559] mount           D    0 79830      1 0x00000001
[1213689.325560] Call trace:
[1213689.325562]  __switch_to+0x9c/0xd8
[1213689.325565]  __schedule+0x2a0/0x888
[1213689.325567]  schedule+0x30/0x88
[1213689.325569]  schedule_preempt_disabled+0x14/0x20
[1213689.325571]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325573]  __mutex_lock_slowpath+0x24/0x30
[1213689.325575]  mutex_lock+0x48/0x50
[1213689.325577]  __blkdev_get+0x70/0x488
[1213689.325579]  blkdev_get+0x10c/0x368
[1213689.325581]  blkdev_open+0x9c/0xb0
[1213689.325583]  do_dentry_open+0x11c/0x340
[1213689.325584]  vfs_open+0x38/0x48
[1213689.325586]  do_last+0x224/0x830
[1213689.325588]  path_openat+0x68/0x238
[1213689.325590]  do_filp_open+0x70/0xd0
[1213689.325592]  do_sys_open+0x15c/0x1e8
[1213689.325594]  __arm64_sys_openat+0x2c/0x38
[1213689.325596]  el0_svc_common+0x98/0x100
[1213689.325598]  el0_svc_handler+0x38/0x78
[1213689.325600]  el0_svc+0x8/0xc
[1213689.325606] mount           D    0 83698      1 0x00000001
[1213689.325607] Call trace:
[1213689.325609]  __switch_to+0x9c/0xd8
[1213689.325612]  __schedule+0x2a0/0x888
[1213689.325614]  schedule+0x30/0x88
[1213689.325616]  schedule_preempt_disabled+0x14/0x20
[1213689.325619]  __mutex_lock.isra.1+0x2c0/0x4b8
[1213689.325621]  __mutex_lock_slowpath+0x24/0x30
[1213689.325623]  mutex_lock+0x48/0x50
[1213689.325625]  __blkdev_get+0x70/0x488
[1213689.325627]  blkdev_get+0x10c/0x368
[1213689.325629]  blkdev_open+0x9c/0xb0
[1213689.325630]  do_dentry_open+0x11c/0x340
[1213689.325632]  vfs_open+0x38/0x48
[1213689.325634]  do_last+0x224/0x830
[1213689.325636]  path_openat+0x68/0x238
[1213689.325638]  do_filp_open+0x70/0xd0
[1213689.325640]  do_sys_open+0x15c/0x1e8
[1213689.325641]  __arm64_sys_openat+0x2c/0x38
[1213689.325643]  el0_svc_common+0x98/0x100
[1213689.325645]  el0_svc_handler+0x38/0x78
[1213689.325647]  el0_svc+0x8/0xc
...


--1548675978.f72523.16651
Date: Mon, 28 Jan 2019 11:46:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123348

            Bug ID: 1123348
           Summary: Error in make kernel or its documentation. Missing targets.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: carlos.e.r-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I tried this, which had been working for a decade at least and is documented:

Telcontar:~ # cd /usr/src/linux
Telcontar:/usr/src/linux # make cloneconfig
make[1]: *** No rule to make target 'cloneconfig'.  Stop.
make: *** [Makefile:569: cloneconfig] Error 2
Telcontar:/usr/src/linux #

The documentation still says to use it:

/usr/share/doc/packages/kernel-source-4.12.14-lp150.12.45/README.SUSE:

�In addition, the running kernel exposes a gzip compressed version of its
configuration file as /proc/config.gz. The kernel sources can be
configured based on /proc/config.gz with ``make cloneconfig''.�

The alternative seems to be:

# cd /usr/src/linux/
# zcat /proc/config.gz > .config
# make silentoldconfig

Then I do:

Telcontar:/usr/src/linux # echo -e "\n


--1548749094.f4cC08C40.21359
Date: Tue, 29 Jan 2019 08:04:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123455

            Bug ID: 1123455
           Summary: [Build 20190126] openQA test fails in libreoffice_recent_documents
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/842151/modules/libre
                    office_recent_documents/steps/16
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: LibreOffice
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

LibreOffice 6.2.0.3 has entered openSUSE Factory and fails in the extendes
LO-test suite

The test attempts to 'clear list' in 'recent documentes' (writer), which then
results in a popup 'This operation is not supported on this operating system'

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-desktopapps-documentation@64bit fails in
[libreoffice_recent_documents](https://openqa.opensuse.org/tests/842151/modules/libreoffice_recent_documents/steps/16)

## Test suite description
Maintainer Yaun Ren

## Reproducible

Fails since (at least) Build
[20190126](https://openqa.opensuse.org/tests/841678)

## Expected result

Last good: [20190125](https://openqa.opensuse.org/tests/839972) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?version=Tumbleweed&flavor=DVD&distri=opensuse&arch=x86_64&machine=64bit&test=desktopapps-documentation)


--1548765498.c77Ff5.25742
Date: Tue, 29 Jan 2019 12:38:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123498

            Bug ID: 1123498
           Summary: VUL-0: CVE-2019-6690: python-python-gnupg: improper input validation in gnupg.GPG.encrypt() and gnupg.GPG.decrypt()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/223877/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: adrian.glaubitz-at-suse.com, alarrosa-at-suse.com,
                    aplanas-at-suse.com, dmueller-at-suse.com, mcepl-at-suse.com,
                    mimi.vx-at-gmail.com, p.drouand-at-gmail.com,
                    pavlix-at-pavlix.net, petr-at-cervinka.net,
                    rjschwei-at-suse.com, sleep_walker-at-opensuse.org,
                    stephan.barth-at-suse.com, tbechtold-at-suse.com,
                    tchvatal-at-suse.com, toddrme2178-at-gmail.com
          Found By: Security Response Team
           Blocker: ---

From the source :

We discovered a way to inject data through the passphrase property of the
gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods when symmetric encryption
is used.
The supplied passphrase is not validated for newlines, and the library passes
--passphrase-fd=0 to the gpg executable, which expects the passphrase on the
first line of stdin, and the ciphertext to be decrypted or plaintext to be
encrypted on subsequent lines.

By supplying a passphrase containing a newline an attacker can control/modify
the ciphertext/plaintext being decrypted/encrypted.

Vulnerable in:  python-gnupg 0.4.3 and maybe earlier versions.
Mitigation   :  Users should upgrade to python-gnupg 0.4.4

Upstream     :

https://github.com/stigtsp/CVE-2019-6690-python-gnupg-vulnerability

https://github.com/vsajip/python-gnupg/commit/39eca266dd837e2ad89c94eb17b7a6f50b25e7cf#diff-88b99bb28683bd5b7e3a204826ead112

https://github.com/vsajip/python-gnupg/commit/3003b654ca1c29b0510a54b9848571b3ad57df19#diff-88b99bb28683bd5b7e3a204826ead112

References   :

https://blog.hackeriet.no/cve-2019-6690-python-gnupg-vulnerability/
https://ctftime.org/task/7458

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1670364
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6690


--1548776878.D61fBd1.29710
Date: Tue, 29 Jan 2019 15:47:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123538

            Bug ID: 1123538
           Summary: Kernel panic while booting from Net & DVD ISO
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: vinz-at-vinzv.de
        QA Contact: jsrain-at-suse.com
        Depends on: 1123523
          Found By: ---
           Blocker: ---

In the aftermath of #1123523 I tried Build402.2 on the same device but ran into
a Kernel panic. The green progress bar at the bottom starts loading normally
but suddenly at 3/4 stops and switching to TTY2 (before the bar stops) shows a
kernel panic.

The device is equipped with:
- Core i7-8750H
- GTX1060 (Optimus)
- Ultra-HD display (3840 x 2160px)


--1548781992.e5000.7141
Date: Tue, 29 Jan 2019 17:13:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123557

            Bug ID: 1123557
           Summary: network:vpn/openvpn: Bug  --suppress-timestamps unneeded in systemd unit file?
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: 3rd party software
          Assignee: max-at-suse.com
          Reporter: jon.brightwell-at-zpg.co.uk
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
                CC: nirmoy.das-at-suse.com
          Found By: ---
           Blocker: ---

It makes logging hard (no timestamps!) and doesn't seem to affect journalctl. I
changed mine to

ExecStart=/usr/sbin/openvpn --daemon --writepid /run/openvpn/%i.pid --cd
/etc/openvpn/ --config %i.conf

Does it also need a wait so it doesn't spit of these
openvpn-at-lab.service: PID file /run/openvpn/lab.pid not readable (yet?) after
start: No such file or directory


--1548837814.bcA06Fee0.12137
Date: Wed, 30 Jan 2019 08:43:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123638

            Bug ID: 1123638
           Summary: Spectacle disappears when catching 'window under mouse pointer'
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: axel.braun-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Launch spectacle from Print-key
Change capture to 'Window under mouse pointer', 'on click'
Record new snapshot.
Result: Spectacle does not come up again to save screenshot.
Need to kill it from task manager
Workaround: Capture rectangular area


--1548838655.5360a7670.21605
Date: Wed, 30 Jan 2019 08:57:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123642

            Bug ID: 1123642
           Summary: When write some notes on Cyrillic in the Guest summary form for KVM and shutdown the guest then it can not start
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: 64bit
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-forge.provo.novell.com
          Reporter: kiv-at-mail.orbitel.bg
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In the guest form 'summary' of virt-manager there are available fields to put
some notes about the guest, such as the fields 'Description' or 'Headline'.
If I create a virtual machine using virt-manager then this machine works just
fine. I can start and stop it and update the host OS without any problem but
only if the fields 'Description' or 'Headline' in this form are empty.
If I put some note written in Cyrillic there,save and shut down the machine
then I can not start it again.
When start it from the virt-manager it show a start-up error like following:

Hook script execution failed: internal error: Child process (LC_ALL=C
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
/etc/libvirt/hooks/qemu MYVM-18-TEST prepare begin -) unexpected exit status 1:
Traceback (most recent call last):
  File "/etc/libvirt/hooks/qemu", line 281, in <module>
    tree = etree.fromstring(vmxml)
  File "src/lxml/etree.pyx", line 3227, in lxml.etree.fromstring
  File "src/lxml/parser.pxi", line 1871, in lxml.etree._parseMemoryDocument
  File "src/lxml/parser.pxi", line 1752, in lxml.etree._parseDoc
  File "src/lxml/parser.pxi", line 1066, in
lxml.etree._BaseParser._parseUnicodeDoc
  File "src/lxml/parser.pxi", line 598, in
lxml.etree._ParserContext._handleParseResultDoc
  File "src/lxml/parser.pxi", line 709, in lxml.etree._handleParseResult
  File "src/lxml/parser.pxi", line 638, in lxml.etree._raiseParseError
  File "<string>", line 4
lxml.etree.XMLSyntaxError: Char 0xDCD1 out of allowed range, line 4, column 41

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 89, in
cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 125, in tmpcb
    callback(*args, **kwargs)
  File "/usr/share/virt-manager/virtManager/libvirtobject.py", line 82, in
newfn
    ret = fn(self, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/domain.py", line 1508, in startup
    self._backend.create()
  File "/usr/lib64/python3.6/site-packages/libvirt.py", line 1069, in create
    if ret == -1: raise libvirtError ('virDomainCreate() failed',

After it I could not found any useful solution to fix this, but if I create a
new guest importing the same virtual hdd via virt-manager and do not write
anything in the mentioned fields same guest works just fine.
I am using KVM on openSUSE since years and in past could write there my notes.
But after some OS updates of the host it start to show this behaviour.

The guest virtual machines where I tested this are installed with openSUSE Leap
15 Linux.

I believe it may be a bug as the KVM server in past did not show such problems.
As far I remember on that time it worked on Leap 42.3
If you believe it is not a bug I will be glad to point me where to get info how
to overcome this problem.


body:
--1548841838.3AdB1Aaa4.6131
Date: Wed, 30 Jan 2019 09:50:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123654

            Bug ID: 1123654
           Summary: texlive-ukrhyph-doc supplements illegal locale en_UK
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: ma-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The official iso code is `en_GB`.

pkgs: texlive-specs-b texlive-specs-k texlive-specs-l texlive-specs-m texlive-specs-y


--1548857814.FEBD0.28088
Date: Wed, 30 Jan 2019 14:16:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123694

            Bug ID: 1123694
           Summary: Cloud:Tools/cloud-init: Bug clone an instance then running it with a new IP causes ifroute-eth0 to be invalid
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: jdsn-at-suse.com
          Reporter: jon.brightwell-at-zpg.co.uk
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
                CC: rjschwei-at-suse.com
          Found By: ---
           Blocker: ---

If you clone an existing instance and run the clone, it changes IP okay but it
corrupts the ifroute-eth0 and thus doesn't bring up a default gateway.

Example content ifroute-eth0
default 10.1.1.1 - - -

The issue being one too many hyphens.

Manual fix is:
default 10.1.1.1 - eth0
or
default 10.1.1.1 - -


body:
--1548859265.d2283.20693
Date: Wed, 30 Jan 2019 14:41:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123697

            Bug ID: 1123697
           Summary: "rpm -V kernel-default" shows wrong permissions for initrd
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

# rpm -V kernel-default
.M.......  g /boot/initrd-4.12.14-25.23-default

This happens on all distros at least since SLE12-SP3. The reason is that dracut
creates the initrd with permissions 0600 (bug 1008340), but the kernel package
contains a dummy initrd with permissions 0644.

pkgs: kernel-source suse-module-tools


--1548859762.62Ac0.11617
Date: Wed, 30 Jan 2019 14:49:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123699

            Bug ID: 1123699
           Summary: libvirt does not start default network automatically
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: agraul-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 795623
  --> http://bugzilla.opensuse.org/attachment.cgi?id=795623&action=edit
libvirt network default not enabled

On a recent TW installation (Snapshot 20190125) that uses wicked (server role),
the default network was not started automatically.

Reproduction:
1. Install yast2-vm
2. Using yast2 virtualization: Install virtualization stack (xen server +
tools, kvm server + tools, libvirt-lxc) and enable the virtualization bridge as
the yast popup proposes
3. Start the libvirtd systemd service via `systemctl start libvirtd.service`
4. `virsh net-info default` shows that the 'default' network is not active.

Expected result:
The default network is started when libvirtd is started via systemctl, which
allows commands like `virt-install` to succeed.

See additional discussion: https://progress.opensuse.org/issues/41093


--1548865893.F87C5.18484
Date: Wed, 30 Jan 2019 16:31:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123721

            Bug ID: 1123721
           Summary: suse-module-tools must not depend on mkintird / dracut
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Discussion on https://build.opensuse.org/request/show/657402 and via email.

Email from Dominique Leuenberger, 2019-01-24

-------------
Some more thinking and tinkering around the problems with suse-module-
tools - and your https://github.com/openSUSE/rpm-config-SUSE/pull/6

Adding a runtime dependency from suse-module-tools to dracut is a bad
thing (with the current setup), as you already know:
* coreutils buildrequires suse-module-tools in order to get the initrd
macros in place.
* coreutils is part of the distro bootstrap cycle (which is already
large/too large). Adding dracut (plus dependency chain) into this cycle
will make it close to impossible to bootstrap any new distro, namely
SLE16

This shall not mean that dracut as a dependency on suse-module-tools is
wrong per se, and as you did in the last weeks, we should try to find a
solution for this issue, and I think the started path is not the worst:

* we remove the macro to rebuild the initrd from suse-module-tools, and
move that to a common place (rpm-config-SUSE comes to mind, it already
contains commonly used macros)
* With this, coreutils could completely give up on the dependency on
suse-module-tools, which means s-module-tools could be downgraded from
a ring0 to a ring1 package. The macro is already smart enough to skipt
over the execution of /usr/lib/module-init-tools/regenerate-initrd-
posttrans if it does not exist
* An additional problem will show up though: dracut requires suse-
module-tools, and suse-module-tools will require dracut. To break that
cycle in OBS you will have to add a "#!BuildIgnore: suse-module-tools"
to suse-module-tools.spec.

This way forward would solve the technical difficulties we have around
building a self-contained distro, without making it harder on the
distro maintainers AND will allow us to add a dependency to s-m-t that
is being interpreted by OBS (or we could even add a fileprovides then -
once coreutils no longer cares for it)

If any mail recipient has a valid reason AGAINST this plan, please
speak up - but please also offer alternative solutions. Otherwise,
let's get things moving. There are still two ring0 packages that will
need touching (rpm-config-SUSE and coreutils) - and ring0 packages are
'tough' as they put a high load onto the distro build, meaning stagins
willing to take them are scarse.
-------------

https://github.com/openSUSE/rpm-config-SUSE/pull/6 has been accepted for
rpm-config-SUSE. The initrd-related macros have _not_ been removed from
suse-module-tools yet (15.0.20).

The dependency on mkinitrd has been replaced by a weak "recommends".


--1548888486.CdBa0.7999
Date: Wed, 30 Jan 2019 22:48:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123747

            Bug ID: 1123747
           Summary: AUDIT-0: udisks2: polkit-untracked-privilege
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: bjorn.lie-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi Sec team - New priv for a new sub-package for udisks2

[  543s] libudisks2-0_vdo.x86_64: E: polkit-untracked-privilege (Badness:
10000) org.freedesktop.udisks2.vdo.manage-vdo
(auth_admin:auth_admin:auth_admin_keep)

Since this is an all auth_admin thing I expect it to be a walk in the park :-)

Package lives in

https://build.opensuse.org/package/show/home:iznogood:factory/udisks2

Please review.


--1548920267.aDEFD60.23915
Date: Thu, 31 Jan 2019 07:37:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123781

            Bug ID: 1123781
           Summary: catfish fails to build againtst python  3.7
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Xfce
          Assignee: bnc-team-xfce-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

openSUSE:Factory was updated to python 3.7
At the same time, thunar was updated to require catfish

Unfortunately, catfish fails to build with python 3.7

Paired with the dependency from thunar to catfish this means we are unable to
build an XFCE Live CD (Rescue CD) and thunar, thus xfce, is not installable on
new TW snapshots (snapshot not released, so this bug is actually blocking)


--1548921093.0646ACC1.29946
Date: Thu, 31 Jan 2019 07:51:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123784

            Bug ID: 1123784
           Summary: xkeyboard-config: evdev keys KEY_RFKILL and KEY_WWAN are not currently mapped
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: sndirsch-at-suse.com
          Reporter: sebastian.parschauer-at-suse.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

I have a brand new Dell Inspiron 13 7380 laptop. The rfkill key is handled by
the dell_laptop driver and that one emits keycode 247 (KEY_RFKILL). But
KEY_RFKILL is not mapped in xkeyboard-config.

I've found and tested the upstream bug and patch:
> https://bugs.freedesktop.org/show_bug.cgi?id=100970
> https://patchwork.freedesktop.org/patch/155965/

This is working with that patch. I applied the changes from the patch manually
and followed some instructions to make the change effective:
> rm -rf /var/lib/xkb/*
> shutdown -r now

HW test report:
> https://en.opensuse.org/HCL:Dell_laptops#Inspiron_7xxx

HW details:
> https://www.dell.com/en-us/work/shop/dell-laptops-and-notebooks/new-inspiron-13-7000/spd/inspiron-13-7380-laptop/CAI137W10PC23

Please apply that patch to openSUSE Leap 15.0 as well. TIA


--1548941969.F5d12Bf6.10129
Date: Thu, 31 Jan 2019 13:39:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1123869

            Bug ID: 1123869
           Summary: tracker-extract: Could not insert metadata for item repeated many times
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: carlos.e.r-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 795707
  --> http://bugzilla.opensuse.org/attachment.cgi?id=795707&action=edit
"TRACKER_VERBOSITY=3 /usr/lib/tracker-extract > tracker-extract.problem.log"
result.

Hi,

I get this error in the log:

<1.4> 2019-01-31 14:20:49 Legolas tracker-extract 14871 - -  Could not insert
metadata for item
"file:///home/cer/Pictures/2015/09/DSC_0064_NEF_embedded.jpg": Unable to insert
multiple values for subject `urn:uuid:a2298b0b-4c1e-1b25-10a2-7b459b80a230' and
single valued property `nie:contentCreated' (old_value: '<untransformable>',
new value: '<untransformable>')
<1.4> 2019-01-31 14:20:49 Legolas tracker-extract 14871 - -  If the error above
is recurrent for the same item/ID, consider running "tracker-extract" in the
terminal with the TRACKER_VERBOSITY=3 environment variable, and filing a bug
with the additional information
<1.4> 2019-01-31 14:20:49 Legolas tracker-extract 14871 - -  Could not insert
metadata for item
"file:///home/cer/Pictures/2015/09/DSC_0075_NEF_embedded.jpg": Unable to insert
multiple values for subject `urn:uuid:7af9dc0e-8530-f4c7-4be5-60806a18ab56' and
single valued property `nie:contentCreated' (old_value: '<untransformable>',
new value: '<untransformable>')
<1.4> 2019-01-31 14:20:49 Legolas tracker-extract 14871 - -  If the error above
is recurrent for the same item/ID, consider running "tracker-extract" in the
terminal with the TRACKER_VERBOSITY=3 environment variable, and filing a bug
with the additional information
<1.4> 2019-01-31 14:20:49 Legolas tracker-extract 14871 - -  Could not insert
metadata for item "file:///home/cer/Pictures/2015/08/DSC_0041.JPG": Unable to
insert multiple values for subject
`urn:uuid:c1885e85-7a79-fc97-35d4-38faf93eba66' and single valued property
`nie:contentCreated' (old_value: '<untransformable>', new value:
'<untransformable>')
<1.4> 2019-01-31 14:20:49 Legolas tracker-extract 14871 - -  If the error above
is recurrent for the same item/ID, consider running "tracker-extract" in the
terminal with the TRACKER_VERBOSITY=3 environment variable, and filing a bug
with the additional information

It has been happening for months:

/var/log/messages-20180724.xz:2018-06-17T21:18:23.948456+02:00 Legolas
tracker-extract[15046]: Could not insert metadata for item
"file:///home/cer/Documents/OO/untitled_.odt": Unable to insert multiple values
for >
/var/log/messages-20180724.xz:2018-06-18T13:14:56.624246+02:00 Legolas
tracker-extract[31615]: Could not insert metadata for item
"file:///home/cer/Documents/OO/untitled_.odt": Unable to insert multiple values
for >

/var/log/messages-20180902.xz:<1.4> 2018-09-01 21:37:12 Legolas tracker-extract
3028 - -  Could not insert metadata for item
"file:///home/cer/Pictures/2015/09/DSC_0064_NEF_embedded.jpg": Unable to insert
multiple >

Thus, I'm reporting.


body:
--1548944523.ff13b00.5561
Date: Thu, 31 Jan 2019 14:22:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1123878

            Bug ID: 1123878
           Summary: pam-config should support pam_mktemp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: 64bit
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.kofahl-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

pam-config should be aware of pam_mktemp. Currently, one has to decide whether
to use the very helpful pam-config or to configure pam manually just to use
pam_mktemp.

summary: pam-config should support pam_mktemp


--1549210306.3FF70.21864
Date: Sun, 3 Feb 2019 16:11:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1124088

            Bug ID: 1124088
           Summary: /bin/dracut-emergency refers to /dev/consoles (with an s)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Bootloader
          Assignee: jsrain-at-suse.com
          Reporter: tjcw-at-cantab.net
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

I had a problem booting, which turned out to be that my root fs needed an fsck.
I got this message from the boot process:

/bin/dracut-emergency: line 43: /dev/consoles: No such file or diectory
Give root password for maintenance
(or press Control-D to continue)

I gave the root password, did 'cat /bin/dracut-emergency', and line 43 did
indeed refer to /dev/consoles . I take it that this should be /dev/console .

Please change if appropriate.


--1549278368.3230c1740.15238
Date: Mon, 4 Feb 2019 11:06:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1124140

            Bug ID: 1124140
           Summary: Crash around _Sp_make_shared_tag when mixing g++7 and g++8 binaries
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: rguenther-at-suse.com
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The issue, to which I have not yet been able to make a minimal testcase,
involves mixing g++-7 binaries with g++-8 generated libraries, both using
std::make_shared in some fashion.

Just by looking at the GCC commits, I found something that looks like a bugfix
in gcc master:

commit 3c1c2a8c6bc4a24ebd235a3c2ba8e6b89fbd3208
Author: redi <redi@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Fri Jan 18 21:28:48 2019 +0000

    PR libstdc++/88782 avoid ODR problems in std::make_shared
    ...
    git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@268086
138bc75d-0d04-0410-961f-82ee72b054a4

I believe it is that bug that I am hitting with openSUSE's gcc 8.


--1549283115.6aDf8045.3084
Date: Mon, 4 Feb 2019 12:25:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1124152

            Bug ID: 1124152
           Summary: /etc/resolv.conf no symlink to /run/netconfig/resolv.conf
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: mt-at-suse.com
          Found By: ---
           Blocker: ---

With the openSUSE Tumbleweed snapshot from yesterday, I have now a
/run/netconfig/resolv.conf, but /etc/resolv.conf is no symlink. Which means, no
nameservers are configured and I cannot access the network.