espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-08 03:37:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mbedtls] call mbedtls_ssl_set_hostname on setup (#11416)

Browse Source 
Due to CVE-2025-27809, on newer versions of mbedtls, handshake
will fail unless hostname is set earlier.

TLS clients are not affected if they operate in a closed ecosystem
where the trusted certificate authority only issues certificates
to trusted hosts.

In this case, `mbedtls_ssl_set_hostname` with nullptr should
be called to avoid failures.

Signed-off-by: Maciej Baczmanski <[email protected]>
This commit is contained in:
Maciej Baczmański
2025-04-16 08:40:55 -06:00
committed by GitHub
parent ad2c33c16c
commit b4282a82f2
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/meshcop/secure_transport.cpp
+7
View File
@@ -311,6 +311,13 @@ Error SecureSession::Setup(void)
VerifyOrExit(rval == 0);
}
#if defined(MBEDTLS_X509_CRT_PARSE_C)
if (!mIsServer)
{
mbedtls_ssl_set_hostname(&mSsl, nullptr);
}
#endif
mReceiveMessage = nullptr;
mMessageSubType = Message::kSubTypeNone;