SSSD / ding-libs

#1698 libdhash: hash table subject algorithmic complexity attacks
Closed: wontfix by atikhonov. Opened by jhrozek.

Closed: wontfix
Reopen Issue

https://bugzilla.redhat.com/show_bug.cgi?id=882334 (Red Hat Enterprise Linux 6)

The internal hash function for strings uses this construct:
        for (h = 0, k = (unsigned char *) key->str; *k; k++)
            h = h * PRIME_1 ^ (*k - ' ');
It might be a good idea to switch to a keyed hash function (like Bob Jenkins'
lookup3 function).
I don't know if libdhash is used in ways that expose this and allow attackers
to mount algorithmic complexity denial-of-service attacks (a few thousand
entries with attacker-controlled keys would be needed), or if client code
depends on the predictable iteration order.

Fields changed

blockedby: =>
blocking: =>
coverity: =>
design: =>
design_review: => 0
feature_milestone: =>
fedora_test_page: =>
milestone: NEEDS_TRIAGE => SSSD 1.10 beta
testsupdated: => 0

Fields changed

selected: => Not need

Moving tickets that are not a priority for SSSD 1.10 into the next release.

milestone: SSSD 1.10 beta => SSSD 1.11 beta

Just FYI, the current recommended hash function is Siphash, so we will need to implement it before we can address this libdhash issue if we determine we need any change at all.

_comment0: Just FYI, the current recommended hash function is SipHash, so we will need to implement it before we can address this libdhash issue if we determine we need any change at all. => 1359043587232935

Fields changed

changelog: =>
milestone: SSSD 1.13 beta => Tools Deferred
review: => 0

Metadata Update from @jhrozek:
- Issue set to the milestone: Tools Deferred

AFAIK, this is not an issue for SSSD.

If there are other users of this lib in the wild who would need this improvement and would like to contribute code - please feel free to reopen this ticket and... patches are welcome.

Metadata Update from @atikhonov:
- Custom field component adjusted to None (was: SSSD)
- Custom field design_review reset (from 0)
- Custom field patch reset (from 0)
- Custom field review reset (from 0)
- Custom field selected adjusted to None (was: Not need)
- Custom field testsupdated reset (from 0)
- Custom field type adjusted to None (was: defect)
- Custom field version adjusted to None
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Normal
None
None
None
false
false
https://bugzilla.redhat.com/show_bug.cgi?id=882334
false
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.