client_connect_tls() in src/shared/transport_tls.c:134-161 enables certificate verification when a CA file is provided (SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)), but it does not configure hostname verification. This means a client using --ca will accept any certificate signed by the CA, even if the certificate was issued for a different hostname, leaving it vulnerable to a man-in-the-middle attack with a valid but mis-issued certificate.
Location
src/shared/transport_tls.c:147-159 — SSL_new(), SSL_connect() called without setting the expected peer hostname.
src/shared/transport_tls.c:73-74 — SSL_VERIFY_PEER is set but hostname check is missing.
Suggested fix
Use SSL_set1_host(ssl, host) or X509_VERIFY_PARAM_set1_host() to verify that the certificate matches the server hostname provided via --server-host.
After SSL_connect(), optionally call SSL_get_verify_result() and confirm it is X509_V_OK.
Severity
Medium
Category
security
This issue was automatically generated by the issue-creator agent.
## Description
`client_connect_tls()` in `src/shared/transport_tls.c:134-161` enables certificate verification when a CA file is provided (`SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)`), but it does not configure hostname verification. This means a client using `--ca` will accept any certificate signed by the CA, even if the certificate was issued for a different hostname, leaving it vulnerable to a man-in-the-middle attack with a valid but mis-issued certificate.
## Location
- `src/shared/transport_tls.c:147-159` — `SSL_new()`, `SSL_connect()` called without setting the expected peer hostname.
- `src/shared/transport_tls.c:73-74` — `SSL_VERIFY_PEER` is set but hostname check is missing.
## Suggested fix
1. Use `SSL_set1_host(ssl, host)` or `X509_VERIFY_PARAM_set1_host()` to verify that the certificate matches the server hostname provided via `--server-host`.
2. After `SSL_connect()`, optionally call `SSL_get_verify_result()` and confirm it is `X509_V_OK`.
## Severity
Medium
## Category
security
---
_This issue was automatically generated by the issue-creator agent._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
client_connect_tls()insrc/shared/transport_tls.c:134-161enables certificate verification when a CA file is provided (SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)), but it does not configure hostname verification. This means a client using--cawill accept any certificate signed by the CA, even if the certificate was issued for a different hostname, leaving it vulnerable to a man-in-the-middle attack with a valid but mis-issued certificate.Location
src/shared/transport_tls.c:147-159—SSL_new(),SSL_connect()called without setting the expected peer hostname.src/shared/transport_tls.c:73-74—SSL_VERIFY_PEERis set but hostname check is missing.Suggested fix
SSL_set1_host(ssl, host)orX509_VERIFY_PARAM_set1_host()to verify that the certificate matches the server hostname provided via--server-host.SSL_connect(), optionally callSSL_get_verify_result()and confirm it isX509_V_OK.Severity
Medium
Category
security
This issue was automatically generated by the issue-creator agent.