You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@thrift.apache.org by "Hudson (JIRA)" <ji...@apache.org> on 2016/03/02 16:55:18 UTC

[jira] [Commented] (THRIFT-3599) Validate client IP address against cert's SubjectAltName

    [ https://issues.apache.org/jira/browse/THRIFT-3599?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15175829#comment-15175829 ] 

Hudson commented on THRIFT-3599:
--------------------------------

FAILURE: Integrated in Thrift-precommit #243 (See [https://builds.apache.org/job/Thrift-precommit/243/])
THRIFT-3599 Validate client IP address against cert's SubjectAltName (nsuke: [https://github.com/apache/thrift/commit/ba93d3979e4f7f438658cb459d509559488ba961])
* lib/py/src/transport/sslcompat.py
* lib/py/requirements.txt


> Validate client IP address against cert's SubjectAltName
> --------------------------------------------------------
>
>                 Key: THRIFT-3599
>                 URL: https://issues.apache.org/jira/browse/THRIFT-3599
>             Project: Thrift
>          Issue Type: Bug
>          Components: Python - Library
>            Reporter: Aki Sukegawa
>            Assignee: Aki Sukegawa
>            Priority: Critical
>             Fix For: 0.10.0
>
>
> After THRIFT-3505, python TSSLSocket has client cert support but does not perform any hostname matching.
> That means clients can submit any certificate that is unrelated to them and the server side only check if the cert is in their CA.
> It is in a sense worse than nothing as it can introduce false sense of security.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)