Bug 1125148

Summary:	Version of gmp in Red Hat Enterprise Linux 6 lacks secure exponentiation function mpz_powm_sec ()
Product:	Red Hat Enterprise Linux 6	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	gmp	Assignee:	David Kaspar // Dee'Kej <deekej>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE - Apps <qe-baseos-apps>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.6	CC:	bressers, huzaifas, jkejda, kdudka, ovasik, salmy, tlavigne
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-16 15:21:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1356047

Description Huzaifa S. Sidhpurwala 2014-07-31 07:59:16 UTC

The version of gmp in rhel-6, lacks the secure exponentiation function mpz_powm_sec ().

As per: https://gmplib.org/manual/Integer-Exponentiation.html the existing mpz_pown() is susceptible to timing attacks and should not be used.

Comment 3 Frantisek Kluknavsky 2014-10-30 15:29:27 UTC

This should be fixed as a result of https://bugzilla.redhat.com/show_bug.cgi?id=1110689 - gmp will be rebased to 6.0.0.
I am not a security expert, could you please take a look if the new build satisfies your needs?

Comment 5 Frantisek Kluknavsky 2014-10-30 15:45:00 UTC

Sorry for the misleading noise, rebase will affect RHEL7.

Comment 15 Red Hat Bugzilla 2023-09-14 02:12:18 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days