[
https://issues.apache.org/jira/browse/THRIFT-6087?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6087.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Enforce RFC 6125 wildcard placement in TSSLSocket hostname matching
> -------------------------------------------------------------------
>
> Key: THRIFT-6087
> URL: https://issues.apache.org/jira/browse/THRIFT-6087
> Project: Thrift
> Issue Type: Bug
> Components: C++ - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> matchName() in TSSLSocket.cpp did not enforce RFC 6125 section 6.4.3's
> requirement that a wildcard character may appear only in the leftmost DNS
> label, so a certificate SAN/CN with a non-leftmost wildcard (e.g.
> "example.*.internal.corp") would incorrectly match. Exploitation requires a
> CA-signed certificate with such a wildcard; public CAs are prohibited from
> issuing one under the CA/Browser Forum Baseline Requirements, so realistic
> exposure is limited to deployments trusting a private CA with relaxed
> issuance rules.
> Fixed by rejecting any pattern with a '*' appearing after the first '.'.
> *Affects:* C++ (DefaultClientAccessManager::matchName / TSSLSocketFactory
> path)
> *Fixed by:* commit 0d7d0f4833, PR #3506; fixed in 0.24.0
> *CWE-297:* Improper Validation of Certificate with Host Mismatch
> *CVSS 4.0:* 8.2 High
> ({{CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N}})
> *Reported by:* discovered internally during a security review (2026-05-21)
> *CVE:* CVE-2026-48145
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
