Hashing problem while signing using sha1

Bug #969206 reported by Bogdan Duda
4
This bug affects 1 person
Affects Status Importance Assigned to Milestone
dkimpy
Fix Released
High
Stuart Gathman
dkimpy (Ubuntu)
Fix Released
Medium
Scott Kitterman

Bug Description

Hardcoded hasher in dkim.__init__.py at line 448 (see rev 83) => causes inconsistency in signature => bad signature

The line should be:
h = hasher()

Cheers!

Related branches

Revision history for this message
Stuart Gathman (stuart-gathman) wrote :

Fixed in revision 85

Changed in dkimpy:
status: New → Fix Released
status: Fix Released → Fix Committed
importance: Undecided → High
assignee: nobody → Stuart Gathman (stuart-gathman)
milestone: none → 0.5.2
Changed in dkimpy (Ubuntu):
status: New → In Progress
assignee: nobody → Scott Kitterman (kitterman)
Changed in dkimpy (Ubuntu):
importance: Undecided → Medium
status: In Progress → Fix Committed
milestone: none → ubuntu-12.04
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dkimpy - 0.5.1-1ubuntu2

---------------
dkimpy (0.5.1-1ubuntu2) precise; urgency=low

  * Cherrypick bug fixes from upstream trunk
    - Fixed hashing problem when using sha1 (rev 85) (LP: #969206)
    - Added test suite coverage for bag handling of b= tag folding (rev 87)
    - Fold b= tags before signing to work around validation issues at Hotmail
      and Yahoo and correctly (per RFC) ignore FWS in b= tag when verifying
      signatures (rev 88)
 -- Scott Kitterman <email address hidden> Tue, 24 Apr 2012 09:36:00 -0400

Changed in dkimpy (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Stuart Gathman (stuart-gathman) wrote :

I should probably add a test case even though this was apparently a typo. Would be good to test sha1 as well as sha256 in test cases.

Changed in dkimpy:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.