Jens Geyer created THRIFT-6086:
----------------------------------
Summary: Add peer hostname validation to c_glib TLS client
Key: THRIFT-6086
URL: https://issues.apache.org/jira/browse/THRIFT-6086
Project: Thrift
Issue Type: Bug
Components: C glib - Library
Reporter: Jens Geyer
Fix For: 0.24.0
thrift_ssl_socket_handle_handshake() called SSL_connect() then
thrift_ssl_socket_authorize(), which checked only certificate chain validity
(SSL_get_verify_result()). When authorize_peer was NULL (the common case, no
custom access manager), the hostname presented in the certificate was never
checked against the hostname the client intended to connect to.
Fixed by calling SSL_set1_host(ssl_socket->ssl, socket->hostname) before
SSL_connect() for client-mode sockets (OpenSSL >= 1.0.2), so a hostname
mismatch surfaces through the existing SSL_get_verify_result() check.
*Affects:* c_glib
*Fixed by:* commit acf2d30bc9, PR #3507; fixed in 0.24.0
*CWE-297:* Improper Validation of Certificate with Host Mismatch
*CVSS 4.0:* 9.1 Critical
({{CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N}})
*Reported by:* discovered internally during a security review (2026-05-21)
*CVE:* CVE-2026-48144
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
