Bug 959454 - plexus-digest: do not use algorithm name as regular expression
Summary: plexus-digest: do not use algorithm name as regular expression
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: plexus-digest
Version: 20
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Mikolaj Izdebski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 959453 1009411
TreeView+ depends on / blocked
 
Reported: 2013-05-03 14:21 UTC by Florian Weimer
Modified: 2013-10-02 07:30 UTC (History)
7 users (show)

Fixed In Version: 1.1-14
Clone Of:
: 1009411 (view as bug list)
Environment:
Last Closed: 2013-10-02 07:30:00 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Florian Weimer 2013-05-03 14:21:51 UTC 
In org.codehaus.plexus.digest.DigestUtils.cleanChecksum(String, String, String), the second parameter is used as part of the regular expression.  Compiling the resulting regular expression can result in a VM error with a crafted algorithm name.  The regular expression should be a constant, with a capture group for the algorithm name, and the name should be checked after matching.
Comment 1 Fedora End Of Life 2013-09-16 13:46:04 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 20 development cycle.
Changing version to '20'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora20
Comment 2 Mikolaj Izdebski 2013-09-27 13:11:10 UTC 
Fixed in plexus-digest-1.1-14
Comment 3 Fedora Update System 2013-09-27 15:16:30 UTC 
plexus-digest-1.1-14.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/plexus-digest-1.1-14.fc20
Comment 4 Mikolaj Izdebski 2013-09-27 15:29:11 UTC 
Patch forwarded upstream:
http://jira.codehaus.org/browse/PLXCOMP-225
Comment 5 Fedora Update System 2013-10-02 06:48:45 UTC 
plexus-digest-1.1-14.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Mikolaj Izdebski 2013-10-02 07:30:00 UTC 
I believe that this bug is fixed in plexus-digest-1.1-14,
which is available in Fedora 20, so I am closing this bug now.

The build containing the fix can be found at Koji:
http://koji.fedoraproject.org/koji/buildinfo?buildID=467576
Note You need to log in before you can comment on or make changes to this bug.