PR #24383 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383.patch
For IP-literal hosts mbedtls_ssl_set_hostname() was skipped, so a CA-trusted certificate for an unrelated name was accepted with no CN/SAN check. Set the name for numeric hosts too; mbedTLS matches IP literals against iPAddress SANs. Fixes: certificate host mismatch accepted for IP-literal hosts (CWE-297) Fixes: oLS26nsaOqUr Found-by: Joshua Rogers <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From 2feeef022704d9c5e78c9284a70164eebd5a4468 Mon Sep 17 00:00:00 2001 From: Joshua Rogers <[email protected]> Date: Sun, 6 Sep 2026 14:55:59 +0200 Subject: [PATCH] avformat/tls_mbedtls: set the expected hostname for numeric hosts For IP-literal hosts mbedtls_ssl_set_hostname() was skipped, so a CA-trusted certificate for an unrelated name was accepted with no CN/SAN check. Set the name for numeric hosts too; mbedTLS matches IP literals against iPAddress SANs. Fixes: certificate host mismatch accepted for IP-literal hosts (CWE-297) Fixes: oLS26nsaOqUr Found-by: Joshua Rogers <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/tls_mbedtls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/tls_mbedtls.c b/libavformat/tls_mbedtls.c index 8f7ace5e63..444148be8a 100644 --- a/libavformat/tls_mbedtls.c +++ b/libavformat/tls_mbedtls.c @@ -673,7 +673,7 @@ static int tls_open(URLContext *h, const char *uri, int flags, AVDictionary **op goto fail; } - if (!shr->listen && !shr->numerichost) { + if (!shr->listen) { if ((ret = mbedtls_ssl_set_hostname(&tls_ctx->ssl_context, shr->host)) != 0) { av_log(h, AV_LOG_ERROR, "mbedtls_ssl_set_hostname returned %d\n", ret); goto fail; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
