This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 57a2e704b4 avformat/tls_mbedtls: set the expected hostname for numeric
hosts
57a2e704b4 is described below
commit 57a2e704b4a6eda5d061b45aacde6b19c026bfc0
Author: Joshua Rogers <[email protected]>
AuthorDate: Sun Sep 6 14:55:59 2026 +0200
Commit: Michael Niedermayer <[email protected]>
CommitDate: Sat Sep 12 18:20:07 2026 +0200
avformat/tls_mbedtls: set the expected hostname for numeric hosts
For IP-literal hosts mbedtls_ssl_set_hostname() was skipped, so a
CA-trusted certificate for an unrelated name was accepted with no CN/SAN
check. Set the name for numeric hosts too; mbedTLS matches IP literals
against iPAddress SANs.
Fixes: certificate host mismatch accepted for IP-literal hosts (CWE-297)
Fixes: oLS26nsaOqUr
Found-by: Joshua Rogers <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavformat/tls_mbedtls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c
index 8f7ace5e63..444148be8a 100644
--- a/libavformat/tls_mbedtls.c
+++ b/libavformat/tls_mbedtls.c
@@ -673,7 +673,7 @@ static int tls_open(URLContext *h, const char *uri, int
flags, AVDictionary **op
goto fail;
}
- if (!shr->listen && !shr->numerichost) {
+ if (!shr->listen) {
if ((ret = mbedtls_ssl_set_hostname(&tls_ctx->ssl_context, shr->host))
!= 0) {
av_log(h, AV_LOG_ERROR, "mbedtls_ssl_set_hostname returned %d\n",
ret);
goto fail;
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
