From 52a36a8f9f12037d4f852b367983297e4db9a605 Mon Sep 17 00:00:00 2001
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Date: Mon, 3 Aug 2026 14:59:21 +0200
Subject: [PATCH] thrift: fix CVE-2026-48144

Backport patch to fix CVE-2026-48144.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-48144

Upstream fix:
  https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../thrift/thrift/CVE-2026-48144.patch        | 36 +++++++++++++++++++
 .../thrift/thrift_0.22.0.bb                   |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch

diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
new file mode 100644
index 0000000000..680cf4481b
--- /dev/null
+++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
@@ -0,0 +1,36 @@
+From 4110973e59758dbeab5f527daae02f3b6a508bb0 Mon Sep 17 00:00:00 2001
+From: Jens Geyer <jensg@apache.org>
+Date: Thu, 21 May 2026 03:05:53 +0200
+Subject: [PATCH] Add peer hostname validation to c_glib TLS client Client:
+ c_glib
+
+Sets SSL_set1_host() before SSL_connect() so the peer certificate CN/SAN
+is validated against the hostname. Guarded with OPENSSL_VERSION_NUMBER
+>= 0x10100000L since SSL_set1_host() was introduced in OpenSSL 1.1.0.
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+
+CVE: CVE-2026-48144
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+index 0afcb1b8f..4423a781c 100644
+--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+@@ -422,6 +422,11 @@ thrift_ssl_socket_handle_handshake(ThriftTransport * transport, GError **error)
+       if(ssl_socket->server){
+ 	  rc = SSL_accept(ssl_socket->ssl);
+       }else{
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++	  if (socket->hostname != NULL) {
++	      SSL_set1_host(ssl_socket->ssl, socket->hostname);
++	  }
++#endif
+ 	  rc = SSL_connect(ssl_socket->ssl);
+       }
+       if (rc <= 0) {
diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
index b3f420bfe3..882e72442a 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
@@ -15,6 +15,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
            file://CVE-2026-43870.patch \
            file://CVE-2026-55971.patch \
            file://CVE-2026-58023.patch \
+           file://CVE-2026-48144.patch \
            "
 SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"