From b4282a82f2b962acf0ec731b3e920f65d53ac9d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20Baczma=C5=84ski?= Date: Wed, 16 Apr 2025 16:40:55 +0200 Subject: [PATCH] [mbedtls] call `mbedtls_ssl_set_hostname` on setup (#11416) Due to CVE-2025-27809, on newer versions of mbedtls, handshake will fail unless hostname is set earlier. TLS clients are not affected if they operate in a closed ecosystem where the trusted certificate authority only issues certificates to trusted hosts. In this case, `mbedtls_ssl_set_hostname` with nullptr should be called to avoid failures. Signed-off-by: Maciej Baczmanski --- src/core/meshcop/secure_transport.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/core/meshcop/secure_transport.cpp b/src/core/meshcop/secure_transport.cpp index a9546ad81..13e61fe32 100644 --- a/src/core/meshcop/secure_transport.cpp +++ b/src/core/meshcop/secure_transport.cpp @@ -311,6 +311,13 @@ Error SecureSession::Setup(void) VerifyOrExit(rval == 0); } +#if defined(MBEDTLS_X509_CRT_PARSE_C) + if (!mIsServer) + { + mbedtls_ssl_set_hostname(&mSsl, nullptr); + } +#endif + mReceiveMessage = nullptr; mMessageSubType = Message::kSubTypeNone;