Bug 1051455

Summary:	alloca used with potentially large arguments
Product:	[Fedora] Fedora	Reporter:	Nikos Mavrogiannopoulos <nmavrogi>
Component:	nettle	Assignee:	Nikos Mavrogiannopoulos <nmavrogi>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	20	CC:	dwmw2, nmavrogi, pwouters, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	nettle-2.7.1-3.fc20	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-01-15 06:08:11 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Nikos Mavrogiannopoulos 2014-01-10 10:22:40 UTC

In several places, TMP_ALLOC is used with potentially large arguments.  This can cause a stack overflow.  Functions taking key_size arguments (e.g., pkcs1_decrypt, pkcs1_encrypt, pkcs1_rsa_digest_encode, ...) and nettle_mpz_random_size are affected.

Comment 1 Fedora Update System 2014-01-10 10:40:13 UTC

nettle-2.7.1-3.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/nettle-2.7.1-3.fc20

Comment 2 Fedora Update System 2014-01-11 08:37:47 UTC

Package nettle-2.7.1-3.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing nettle-2.7.1-3.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-0613/nettle-2.7.1-3.fc20
then log in and leave karma (feedback).

Comment 3 Fedora Update System 2014-01-15 06:08:11 UTC

nettle-2.7.1-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.