[jira] [Resolved] (THRIFT-6087) Enforce RFC 6125 wildcard placement in TSSLSocket hostname matching

["Jens Geyer (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/THRIFT-6087?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jens Geyer resolved THRIFT-6087.
--------------------------------
      Assignee: Jens Geyer
    Resolution: Fixed

> Enforce RFC 6125 wildcard placement in TSSLSocket hostname matching
> -------------------------------------------------------------------
>
>                 Key: THRIFT-6087
>                 URL: https://issues.apache.org/jira/browse/THRIFT-6087
>             Project: Thrift
>          Issue Type: Bug
>          Components: C++ - Library
>            Reporter: Jens Geyer
>            Assignee: Jens Geyer
>            Priority: Major
>             Fix For: 0.24.0
>
>
> matchName() in TSSLSocket.cpp did not enforce RFC 6125 section 6.4.3's requirement that a wildcard character may appear only in the leftmost DNS label, so a certificate SAN/CN with a non-leftmost wildcard (e.g. "example.*.internal.corp") would incorrectly match. Exploitation requires a CA-signed certificate with such a wildcard; public CAs are prohibited from issuing one under the CA/Browser Forum Baseline Requirements, so realistic exposure is limited to deployments trusting a private CA with relaxed issuance rules.
> Fixed by rejecting any pattern with a '*' appearing after the first '.'.
> *Affects:* C++ (DefaultClientAccessManager::matchName / TSSLSocketFactory path)
> *Fixed by:* commit 0d7d0f4833, PR #3506; fixed in 0.24.0
> *CWE-297:* Improper Validation of Certificate with Host Mismatch
> *CVSS 4.0:* 8.2 High ({{CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N}})
> *Reported by:* discovered internally during a security review (2026-05-21)
> *CVE:* CVE-2026-48145



--
This message was sent by Atlassian Jira
(v8.20.10#820010)