[meta-oe][wrynose][PATCH 3/4] thrift: fix CVE-2026-48144

From: Adarsh Jagadish Kamini <[email protected]>

Backport patch to fix CVE-2026-48144.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-48144

Upstream fix:
  https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26=
568a193

Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
---
 .../thrift/thrift/CVE-2026-48144.patch        | 36 +++++++++++++++++++
 .../thrift/thrift_0.22.0.bb                   |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-481=
44.patch

diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patc=
h b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
new file mode 100644
index 0000000000..680cf4481b
--- /dev/null
+++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
@@ -0,0 +1,36 @@
+From 4110973e59758dbeab5f527daae02f3b6a508bb0 Mon Sep 17 00:00:00 2001
+From: Jens Geyer <[email protected]>
+Date: Thu, 21 May 2026 03:05:53 +0200
+Subject: [PATCH] Add peer hostname validation to c_glib TLS client Client:
+ c_glib
+
+Sets SSL_set1_host() before SSL_connect() so the peer certificate CN/SAN
+is validated against the hostname. Guarded with OPENSSL_VERSION_NUMBER
+>=3D 0x10100000L since SSL_set1_host() was introduced in OpenSSL 1.1.0.
+
+Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
+
+CVE: CVE-2026-48144
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/2b8baab=
c9be52807b08825e825bc0cd26568a193]
+
+Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
+---
+ lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/=
lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+index 0afcb1b8f..4423a781c 100644
+--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+@@ -422,6 +422,11 @@ thrift_ssl_socket_handle_handshake(ThriftTransport * =
transport, GError **error)
+       if(ssl_socket->server){
+ 	  rc =3D SSL_accept(ssl_socket->ssl);
+       }else{
++#if OPENSSL_VERSION_NUMBER >=3D 0x10100000L
++	  if (socket->hostname !=3D NULL) {
++	      SSL_set1_host(ssl_socket->ssl, socket->hostname);
++	  }
++#endif
+ 	  rc =3D SSL_connect(ssl_socket->ssl);
+       }
+       if (rc <=3D 0) {
diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe=
/recipes-connectivity/thrift/thrift_0.22.0.bb
index b3f420bfe3..882e72442a 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb
@@ -15,6 +15,7 @@ SRC_URI =3D "https://downloads.apache.org/${BPN}/${PV}/${=
BP}.tar.gz \
            file://CVE-2026-43870.patch \
            file://CVE-2026-55971.patch \
            file://CVE-2026-58023.patch \
+           file://CVE-2026-48144.patch \
            "
 SRC_URI[sha256sum] =3D "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59=
dc64a00df8a1e5"
=20