Cryptographic Issue

[sureshkrishnamoorthy]

Software quality and security analysis tool (Veracode) reports an error "Improper Validation of Certificate with Host Mismatch (CWE ID 297)(1 flaw)" in
https://github.com/netty/netty/blob/netty-4.1.34.Final/handler/src/main/java/io/netty/handler/ssl/OpenSslX509TrustManagerWrapper.java
Description : The failure to validate host-specific certificate data may mean that, while the certificate read was valid, it was not for the site originally requested.

Netty version : 4.1.34.Final

Please let us know if it is a valid issue, if
yes, please suggest how to mitigate this.
no, please provide justification

[normanmaurer]

Sorry but you will have to provide more details.

[sureshkrishnamoorthy]

Veracode vulnerability analysis reports vulnerability at line no 69 in OpenSslX509TrustManagerWrapper.java ie
`

                        context.init(null, new TrustManager[] {
                                                new X509TrustManager() {
                        @Override
                        public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
                                throws CertificateException {
                        }
                        @Override
                        public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
                                throws CertificateException {
                        }

                        @Override
                        public X509Certificate[] getAcceptedIssuers() {
                            return EmptyArrays.EMPTY_X509_CERTIFICATES;
                        }
                    }
            }, null);

`
Reported Issue: Improper Validation of Certificate with Host Mismatch (CWE ID 297)

We assume that in the above overridden methods doesn't have any implementation which might be causing the vulnerability issue.
Please let us know of your views on this issue.

[normanmaurer]

@sureshkrishnamoorthy this is not a "valid report" as this is only used to test if a wrapper is applied and is never used to actual verify certificates at the end.

That said I can make this go away easily. Let me do this to make things "easier" for you.

[normanmaurer]

@sureshkrishnamoorthy fixed by #9041

[sureshkrishnamoorthy]

@normanmaurer Thank you so much for quick response and action. Do we have the release date for 4.1.35.Final version ?