-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
CentOS Stream 9, rhel-9.6, rhel-9.6.z, rhel-9.7, rhel-9.7.z
-
None
-
None
-
None
-
rhel-storage-io-2
-
None
-
False
-
False
-
-
None
-
CentOS Stream, Red Hat Enterprise Linux
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
All
-
None
What were you trying to do that didn't work?
Installing blktrace on a headless server without pulling in graphical libraries. This is because blktrace pulls in librsvg2-tools even though it should only be required by its iowatcher subpackage.
See blktrace's README (iowatcher requires librsvg2-tools starting from 1.1.0) and look at iowatcher/main.c in the source code.
See also https://bugzilla.redhat.com/show_bug.cgi?id=2406001 for Fedora
What is the impact of this issue to you?
The less that is installed on servers the less we need to spend time triaging CVEs that affect packages that are not actually being used (and the less software that can be used for privilege escalation)
Please provide the package NVR for which the bug is seen:
blktrace-1.3.0-13.el10
How reproducible is this bug?:
Always
Steps to reproduce
fedrq pkgs blktrace -b c9s --notsrc -F requires | grep rsvg
fedrq pkgs iowatcher -b c9s --notsrc -F requires | grep rsvg
Expected results
$ fedrq pkgs blktrace -b c9s --notsrc -F requires | grep rsvg
$ fedrq pkgs iowatcher -b c9s --notsrc -F requires | grep rsvg
librsvg2-tools
Actual results
$ fedrq pkgs blktrace -b c9s --notsrc -F requires | grep rsvg
librsvg2-tools
$ fedrq pkgs iowatcher -b c9s --notsrc -F requires | grep rsvg