From eadaf7aae65a096230ee97766eabd6d799284911 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Thu, 3 Sep 2026 16:13:26 -0400 Subject: [PATCH 1/3] [GEODE-10623] Remediation of CVE-2026-64607 --- .../apache/geode/gradle/plugins/DependencyConstraints.groovy | 2 +- .../src/integrationTest/resources/assembly_content.txt | 2 +- .../src/integrationTest/resources/gfsh_dependency_classpath.txt | 2 +- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy index d420632513f5..b8c248d1b228 100644 --- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy +++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy @@ -176,7 +176,7 @@ class DependencyConstraints { api(group: 'org.apache.commons', name: 'commons-text', version: 1.9) api(group: 'org.apache.derby', name: 'derby', version: '10.14.2.0') // Apache HttpComponents 5.x - Modern HTTP client with HTTP/2 support - api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.4.4') + api(group: 'org.apache.httpcomponents.client5', name: 'httpclient5', version: '5.6.4') api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5', version: '5.4.3') api(group: 'org.apache.httpcomponents.core5', name: 'httpcore5-h2', version: '5.4.3') // Legacy HttpComponents 4.x (keep temporarily during migration, remove after complete) diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt index dffec6c6e556..5539a872ece6 100644 --- a/geode-assembly/src/integrationTest/resources/assembly_content.txt +++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt @@ -960,7 +960,7 @@ lib/geode-unsafe-0.0.0.jar lib/geode-wan-0.0.0.jar lib/gfsh-dependencies.jar lib/hibernate-validator-8.0.2.Final.jar -lib/httpclient5-5.4.4.jar +lib/httpclient5-5.6.4.jar lib/httpcore5-5.4.3.jar lib/httpcore5-h2-5.4.3.jar lib/istack-commons-runtime-4.1.1.jar diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt index f5def2e54a92..4a5715307083 100644 --- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt +++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt @@ -59,7 +59,7 @@ lucene-analysis-common-9.12.3.jar lucene-queryparser-9.12.3.jar lucene-queries-9.12.3.jar lucene-core-9.12.3.jar -httpclient5-5.4.4.jar +httpclient5-5.6.4.jar httpcore5-h2-5.4.3.jar httpcore5-5.4.3.jar HikariCP-4.0.3.jar diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index a51051e91f68..120063e15bce 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -25,7 +25,7 @@ jackson-dataformat-yaml-2.21.5.jar jackson-core-2.21.5.jar jackson-datatype-joda-2.21.5.jar jackson-databind-2.21.5.jar -httpclient5-5.4.4.jar +httpclient5-5.6.4.jar httpcore5-h2-5.4.3.jar httpcore5-5.4.3.jar HikariCP-4.0.3.jar From 6be84e47a6a9cd543ca94662ba07dd408916ea26 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Fri, 4 Sep 2026 08:22:56 -0400 Subject: [PATCH 2/3] [GEODE-10623] Honor caller-supplied hostname verifier over HTTPS HttpClient 5.5 changed the hostname verification default on the DefaultClientTlsStrategy(SSLContext, HostnameVerifier) constructor. It previously passed HostnameVerificationPolicy.CLIENT, letting the supplied verifier alone decide whether a certificate matches the endpoint. It now passes no policy, which AbstractClientTlsStrategy resolves to BOTH when a verifier is present, so JSSE endpoint identification runs in addition to the supplied verifier rather than being replaced by it. Pass HostnameVerificationPolicy.CLIENT explicitly when the caller provides a verifier, restoring the documented behavior of ClusterManagementServiceBuilder.setHostnameVerifier. When no verifier is supplied, use the single-argument constructor rather than CLIENT with a null verifier: 5.5 also dropped the substitution of HttpsSupport.getDefaultHostnameVerifier() for a null verifier, so CLIENT with null would skip endpoint checking entirely. The single-argument form keeps the library's own endpoint identification. This surfaced in ClientClusterManagementSSLTest, whose certificate carries CN=localhost with no subjectAltName. The reported symptom was misleading: DefaultHttpClientConnectionOperator performs the TLS upgrade inside its per-address retry loop, so the handshake failure on 127.0.0.1 was treated as a reason to try the next address. localhost also resolves to ::1, where nothing is listening, and that trailing connection refusal was what got reported. --- ...lateClusterManagementServiceTransport.java | 25 +++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/geode-management/src/main/java/org/apache/geode/management/api/RestTemplateClusterManagementServiceTransport.java b/geode-management/src/main/java/org/apache/geode/management/api/RestTemplateClusterManagementServiceTransport.java index dc14b4994ee1..6381001215fb 100644 --- a/geode-management/src/main/java/org/apache/geode/management/api/RestTemplateClusterManagementServiceTransport.java +++ b/geode-management/src/main/java/org/apache/geode/management/api/RestTemplateClusterManagementServiceTransport.java @@ -25,12 +25,14 @@ import java.util.concurrent.Executors; import java.util.concurrent.ScheduledExecutorService; +import javax.net.ssl.HostnameVerifier; import javax.net.ssl.SSLContext; import org.apache.hc.client5.http.impl.classic.HttpClientBuilder; import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder; import org.apache.hc.client5.http.io.HttpClientConnectionManager; import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy; +import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy; import org.springframework.core.io.FileSystemResource; import org.springframework.http.HttpEntity; import org.springframework.http.HttpHeaders; @@ -164,7 +166,7 @@ public void configureConnection(ConnectionConfig connectionConfig) { // Configure SSL context and hostname verifier (HttpClient 5.x approach) // Only configure SSL if we have a non-null SSL context if (connectionConfig.getSslContext() != null) { - DefaultClientTlsStrategy sslSocketFactory = new DefaultClientTlsStrategy( + DefaultClientTlsStrategy sslSocketFactory = createTlsStrategy( connectionConfig.getSslContext(), connectionConfig.getHostnameVerifier()); @@ -178,7 +180,7 @@ public void configureConnection(ConnectionConfig connectionConfig) { // If only hostname verifier is set without SSL context, we need to use the default SSL // context try { - DefaultClientTlsStrategy sslSocketFactory = new DefaultClientTlsStrategy( + DefaultClientTlsStrategy sslSocketFactory = createTlsStrategy( SSLContext.getDefault(), connectionConfig.getHostnameVerifier()); @@ -197,6 +199,25 @@ public void configureConnection(ConnectionConfig connectionConfig) { restTemplate.setRequestFactory(requestFactory); } + /** + * Builds the TLS strategy used for HTTPS connections. + * + *

+ * When the caller supplies a {@link HostnameVerifier}, that verifier alone decides whether the + * peer's certificate matches the endpoint, so the strategy is created with + * {@link HostnameVerificationPolicy#CLIENT}. Without an explicit verifier the strategy keeps the + * library's own endpoint identification. + *

+ */ + private static DefaultClientTlsStrategy createTlsStrategy(SSLContext sslContext, + HostnameVerifier hostnameVerifier) { + if (hostnameVerifier == null) { + return new DefaultClientTlsStrategy(sslContext); + } + return new DefaultClientTlsStrategy(sslContext, HostnameVerificationPolicy.CLIENT, + hostnameVerifier); + } + @Override public > ClusterManagementRealizationResult submitMessage( T configMessage, CommandType command) { From 1b402279020e32288e51df4bf28007edbbb3f878 Mon Sep 17 00:00:00 2001 From: JinwooHwang Date: Fri, 4 Sep 2026 11:44:59 -0400 Subject: [PATCH 3/3] [GEODE-10623] Update expected server-all classpath for httpclient5 5.6.4 --- .../src/integrationTest/resources/dependency_classpath.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt index f4125d361a86..7300c0dd4912 100644 --- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt +++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt @@ -25,7 +25,7 @@ jackson-dataformat-yaml-2.21.6.jar jackson-core-2.21.6.jar jackson-datatype-joda-2.21.6.jar jackson-databind-2.21.6.jar -httpclient5-5.4.4.jar +httpclient5-5.6.4.jar httpcore5-h2-5.4.3.jar httpcore5-5.4.3.jar HikariCP-4.0.3.jar