mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-30 00:33:19 +00:00
Code Issues Projects Releases Wiki Activity

thrift: fix CVE-2026-48144

Browse Source 
Backport patch to fix CVE-2026-48144.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-48144

Upstream fix:
  https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Adarsh Jagadish Kamini
2026-08-03 16:17:12 +02:00
committed by Anuj Mittal
parent 7f5c686d97
commit 35cb02fda2
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
+36
View File
@@ -0,0 +1,36 @@
From 392027cd14deaa7b37d72e1608b57024a1056757 Mon Sep 17 00:00:00 2001
From: Jens Geyer <jensg@apache.org>
Date: Thu, 21 May 2026 03:05:53 +0200
Subject: [PATCH] Add peer hostname validation to c_glib TLS client Client:
c_glib
Sets SSL_set1_host() before SSL_connect() so the peer certificate CN/SAN
is validated against the hostname. Guarded with OPENSSL_VERSION_NUMBER
>= 0x10100000L since SSL_set1_host() was introduced in OpenSSL 1.1.0.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CVE: CVE-2026-48144
Upstream-Status: Backport [https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193]
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
index 0afcb1b8f..4423a781c 100644
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
@@ -422,6 +422,11 @@ thrift_ssl_socket_handle_handshake(ThriftTransport * transport, GError **error)
if(ssl_socket->server){
rc = SSL_accept(ssl_socket->ssl);
}else{
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ if (socket->hostname != NULL) {
+ SSL_set1_host(ssl_socket->ssl, socket->hostname);
+ }
+#endif
rc = SSL_connect(ssl_socket->ssl);
}
if (rc <= 0) {
meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
+1
View File
@@ -14,6 +14,7 @@ SRC_URI = "https://archive.apache.org/dist/${BPN}/${PV}/${BP}.tar.gz \
file://0001-THRIFT-5842-Add-missing-cstdint-include-for-int64_t-.patch \
file://CVE-2026-55971.patch \
file://CVE-2026-58023.patch \
file://CVE-2026-48144.patch \
"
SRC_URI[sha256sum] = "b5d8311a779470e1502c027f428a1db542f5c051c8e1280ccd2163fa935ff2d6"