Jens Geyer created THRIFT-6087:
----------------------------------
Summary: Enforce RFC 6125 wildcard placement in TSSLSocket
hostname matching
Key: THRIFT-6087
URL: https://issues.apache.org/jira/browse/THRIFT-6087
Project: Thrift
Issue Type: Bug
Components: C++ - Library
Reporter: Jens Geyer
Fix For: 0.24.0
matchName() in TSSLSocket.cpp did not enforce RFC 6125 section 6.4.3's
requirement that a wildcard character may appear only in the leftmost DNS
label, so a certificate SAN/CN with a non-leftmost wildcard (e.g.
"example.*.internal.corp") would incorrectly match. Exploitation requires a
CA-signed certificate with such a wildcard; public CAs are prohibited from
issuing one under the CA/Browser Forum Baseline Requirements, so realistic
exposure is limited to deployments trusting a private CA with relaxed issuance
rules.
Fixed by rejecting any pattern with a '*' appearing after the first '.'.
*Affects:* C++ (DefaultClientAccessManager::matchName / TSSLSocketFactory path)
*Fixed by:* commit 0d7d0f4833, PR #3506; fixed in 0.24.0
*CWE-297:* Improper Validation of Certificate with Host Mismatch
*CVSS 4.0:* 8.2 High
({{CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N}})
*Reported by:* discovered internally during a security review (2026-05-21)
*CVE:* CVE-2026-48145
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
