[PR] Fixed: Remove HOSTCERT_MIN_CHECK from SSLUtil (OFBIZ-13482) (backport to release24.09) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak opened a new pull request, #1560:
URL: https://github.com/apache/ofbiz-framework/pull/1560

   Fixed: Remove HOSTCERT_MIN_CHECK from SSLUtil (OFBIZ-13482)
   
   HOSTCERT_MIN_CHECK's HostnameVerifier never compared the hostname to the
   certificate (CWE-297): it called peerCert.verify(peerCert.getPublicKey()),
   a self-signed check unrelated to any hostname or trust-store semantic.
   Removed the level along with its public getHostCertMinCheck() accessor;
   nothing in-tree used it, and HOSTCERT_NORMAL_CHECK already gets full,
   correct hostname validation for free from the JDK's default verifier.
   
   Backport of trunk PR #1559.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fixed: Remove HOSTCERT_MIN_CHECK from SSLUtil (OFBIZ-13482) (backport to release24.09) [ofbiz-framework]

["mridulpathak (via GitHub)" <gi...@apache.org>]

mridulpathak merged PR #1560:
URL: https://github.com/apache/ofbiz-framework/pull/1560


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org