[
https://issues.apache.org/jira/browse/GEODE-10623?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18114947#comment-18114947
]
ASF subversion and git services commented on GEODE-10623:
---------------------------------------------------------
Commit 044a723ac87799d8886fdd07e530c3ef284d36c7 in geode's branch
refs/heads/feature/GEODE-10531 from Jinwoo Hwang
[ https://gitbox.apache.org/repos/asf?p=geode.git;h=044a723ac8 ]
[GEODE-10623] Remediation of CVE-2026-64607 (#8050)
* [GEODE-10623] Remediation of CVE-2026-64607
* [GEODE-10623] Honor caller-supplied hostname verifier over HTTPS
HttpClient 5.5 changed the hostname verification default on the
DefaultClientTlsStrategy(SSLContext, HostnameVerifier) constructor. It
previously passed HostnameVerificationPolicy.CLIENT, letting the supplied
verifier alone decide whether a certificate matches the endpoint. It now
passes no policy, which AbstractClientTlsStrategy resolves to BOTH when a
verifier is present, so JSSE endpoint identification runs in addition to
the supplied verifier rather than being replaced by it.
Pass HostnameVerificationPolicy.CLIENT explicitly when the caller provides
a verifier, restoring the documented behavior of
ClusterManagementServiceBuilder.setHostnameVerifier.
When no verifier is supplied, use the single-argument constructor rather
than CLIENT with a null verifier: 5.5 also dropped the substitution of
HttpsSupport.getDefaultHostnameVerifier() for a null verifier, so CLIENT
with null would skip endpoint checking entirely. The single-argument form
keeps the library's own endpoint identification.
This surfaced in ClientClusterManagementSSLTest, whose certificate carries
CN=localhost with no subjectAltName. The reported symptom was misleading:
DefaultHttpClientConnectionOperator performs the TLS upgrade inside its
per-address retry loop, so the handshake failure on 127.0.0.1 was treated
as a reason to try the next address. localhost also resolves to ::1, where
nothing is listening, and that trailing connection refusal was what got
reported.
* [GEODE-10623] Update expected server-all classpath for httpclient5 5.6.4
> Remediation of CVE-2026-64607
> -----------------------------
>
> Key: GEODE-10623
> URL: https://issues.apache.org/jira/browse/GEODE-10623
> Project: Geode
> Issue Type: Improvement
> Reporter: Jinwoo Hwang
> Assignee: Jinwoo Hwang
> Priority: Major
>
> Remediation of CVE-2026-64607
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
