Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.<\/p>\n
Both libraries install a default access manager for client sockets \u2014 TSSLSocketFactory does so in C++, and the accessManager property does so in D \u2014 which compares the peer certificate against the host<\/p>\n
name that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a “skip” result rather than<\/p>\n
a rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check.<\/p>\n
RFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a<\/p>\n
Common Name for another is therefore accepted for a connection to the second name.<\/p>\n
Exploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client’s trust store and whose Common Name matches the connected host<\/p>\n
name. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure.<\/p>\n
This issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.<\/p>\n","protected":false},"excerpt":{"rendered":"
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.<\/p>\n
Both libraries install a default access manager for client sockets \u2014 TSSLSocketFactory does so in <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-32260","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/32260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=32260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=32260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=32260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}