Bug 2370639 - SEGV due to conflicting hmac_md5() functions
Summary: SEGV due to conflicting hmac_md5() functions
Keywords:
Status: NEW
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: pam_radius
Version: epel9
Hardware: All
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Antonio Torres
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-06 12:19 UTC by Steve Atkins
Modified: 2026-07-23 01:52 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Steve Atkins 2025-06-06 12:19:53 UTC
Description of problem:

Upgrading pam_radius.so from 2.0.0-3 to 2.0.0-4 causes application using
it to SEGV, due to collision with hmac_md5 function.

Version-Release number of selected component (if applicable):

2.0.0-4

How reproducible:


Steps to Reproduce:
1. Have installed application, running correctly, that contains the function
hmac_md5 (from libesmtp):

  void hmac_md5 (const void *challenge, size_t challenge_len,
                 const void *secret, size_t secret_len,
                 unsigned char digest[16]);

2. Upgrade pam_radius.so to 2.0.0-4

3. Use PAM authentication with a facility configured to use pam_radius.so

Actual results:

SEGV.

Stack trace shows that /usr/lib64/security/pam_radius_auth.so has called the hmac_md5()
function within the application, not the one provided by pam-radius-message-auth.patch,
which then ends up in MD5_Update from libcrypto.so.3 and finally ends up SEGVing in libc.

Expected results:

Not SEGV.

Additional info:

Patching the application to rename the hmac_md5() function to something else avoids the issue.

Comment 1 Fedora Admin user for bugzilla script actions 2026-07-23 01:52:22 UTC
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.


Note You need to log in before you can comment on or make changes to this bug.