diff mbox series

[meta-oe,scarthgap,3/3] thrift: fix CVE-2026-48144

Message ID 20260803141716.853285-4-adarsh.jagadish.kamini@est.tech
State New
Headers show
Series thrift: backport security fixes | expand

Commit Message

Adarsh Jagadish Kamini Aug. 3, 2026, 2:17 p.m. UTC 
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>

Backport patch to fix CVE-2026-48144.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-48144

Upstream fix:
  https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
 .../thrift/thrift/CVE-2026-48144.patch        | 36 +++++++++++++++++++
 .../thrift/thrift_0.20.0.bb                   |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
new file mode 100644
index 0000000000..531fb5a52e
--- /dev/null
+++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
@@ -0,0 +1,36 @@ 
+From 392027cd14deaa7b37d72e1608b57024a1056757 Mon Sep 17 00:00:00 2001
+From: Jens Geyer <jensg@apache.org>
+Date: Thu, 21 May 2026 03:05:53 +0200
+Subject: [PATCH] Add peer hostname validation to c_glib TLS client Client:
+ c_glib
+
+Sets SSL_set1_host() before SSL_connect() so the peer certificate CN/SAN
+is validated against the hostname. Guarded with OPENSSL_VERSION_NUMBER
+>= 0x10100000L since SSL_set1_host() was introduced in OpenSSL 1.1.0.
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+
+CVE: CVE-2026-48144
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+index 0afcb1b8f..4423a781c 100644
+--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+@@ -422,6 +422,11 @@ thrift_ssl_socket_handle_handshake(ThriftTransport * transport, GError **error)
+       if(ssl_socket->server){
+ 	  rc = SSL_accept(ssl_socket->ssl);
+       }else{
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++	  if (socket->hostname != NULL) {
++	      SSL_set1_host(ssl_socket->ssl, socket->hostname);
++	  }
++#endif
+ 	  rc = SSL_connect(ssl_socket->ssl);
+       }
+       if (rc <= 0) {
diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
index 35482d2471..20afa8ce59 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb
@@ -14,6 +14,7 @@  SRC_URI = "https://archive.apache.org/dist/${BPN}/${PV}/${BP}.tar.gz \
            file://0001-THRIFT-5842-Add-missing-cstdint-include-for-int64_t-.patch \
            file://CVE-2026-55971.patch \
            file://CVE-2026-58023.patch \
+           file://CVE-2026-48144.patch \
            "
 SRC_URI[sha256sum] = "b5d8311a779470e1502c027f428a1db542f5c051c8e1280ccd2163fa935ff2d6"