File php7-CVE-2026-91769.patch of Package php7

From 0bb308eb4cf699e707efbcf97ffb70e46a176be7 Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Mon, 10 Aug 2026 22:25:55 +0200
Subject: [PATCH] Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert
 has a service ID

RFC 6125 6.4.4 forbids matching CN-ID if the certificate presents a DNS-ID,
SRV-ID or URI-ID. Falling back allowed a CA that validated only one of those
identities to leave an unvalidated CN to be matched as a host name.

IP-ID is left out as it is out of scope of RFC 6125 and suppressing CN there
would break IP-only SAN certificates.
---
 ext/openssl/tests/san_absent_cn_fallback.phpt | 61 ++++++++++++++++++
 ext/openssl/tests/san_no_cn_fallback.phpt     | 64 +++++++++++++++++++
 ext/openssl/tests/san_peer_matching.phpt      |  2 +-
 ext/openssl/tests/san_srv_no_cn_fallback.phpt | 57 +++++++++++++++++
 ext/openssl/tests/san_uri_no_cn_fallback.phpt | 57 +++++++++++++++++
 ext/openssl/xp_ssl.c                          | 28 +++++++-
 6 files changed, 265 insertions(+), 4 deletions(-)
 create mode 100644 ext/openssl/tests/san_absent_cn_fallback.phpt
 create mode 100644 ext/openssl/tests/san_no_cn_fallback.phpt
 create mode 100644 ext/openssl/tests/san_srv_no_cn_fallback.phpt
 create mode 100644 ext/openssl/tests/san_uri_no_cn_fallback.phpt

Index: php-7.4.33/ext/openssl/xp_ssl.c
===================================================================
--- php-7.4.33.orig/ext/openssl/xp_ssl.c
+++ php-7.4.33/ext/openssl/xp_ssl.c
@@ -421,7 +421,8 @@ static zend_bool php_openssl_matches_wil
 }
 /* }}} */
 
-static zend_bool php_openssl_matches_san_list(X509 *peer, const char *subject_name) /* {{{ */
+static zend_bool php_openssl_matches_san_list(
+               X509 *peer, const char *subject_name, zend_bool *has_service_id)
 {
 	int i, len;
 	unsigned char *cert_name = NULL;
@@ -430,10 +431,14 @@ static zend_bool php_openssl_matches_san
 	GENERAL_NAMES *alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, 0, 0);
 	int alt_name_count = sk_GENERAL_NAME_num(alt_names);
 
+        *has_service_id = 0;
+
 	for (i = 0; i < alt_name_count; i++) {
 		GENERAL_NAME *san = sk_GENERAL_NAME_value(alt_names, i);
 
 		if (san->type == GEN_DNS) {
+			*has_service_id = 1;
+
 			ASN1_STRING_to_UTF8(&cert_name, san->d.dNSName);
 			if ((size_t)ASN1_STRING_length(san->d.dNSName) != strlen((const char*)cert_name)) {
 				OPENSSL_free(cert_name);
@@ -472,6 +477,16 @@ static zend_bool php_openssl_matches_san
 			 * Because IP SAN names are officially deprecated and are
 			 * not allowed by CAs starting in 2015. Deal with it.
 			 */
+		} else if (san->type == GEN_URI) {
+			*has_service_id = 1;
+		} else if (san->type == GEN_OTHERNAME) {
+			char oid[32];
+
+			/* SRV-ID, matched by OID because NID_SRVName needs OpenSSL 3.0 */
+			if (OBJ_obj2txt(oid, sizeof(oid), san->d.otherName->type_id, 1) > 0
+				&& strcmp(oid, "1.3.6.1.5.5.7.8.7") == 0) {
+				*has_service_id = 1;
+			}
 		}
 	}
 
@@ -479,7 +494,6 @@ static zend_bool php_openssl_matches_san
 
 	return 0;
 }
-/* }}} */
 
 static zend_bool php_openssl_matches_common_name(X509 *peer, const char *subject_name) /* {{{ */
 {
@@ -585,8 +599,16 @@ static int php_openssl_apply_peer_verifi
 		}
 
 		if (peer_name) {
-			if (php_openssl_matches_san_list(peer, peer_name)) {
+			zend_bool has_service_id = 0;
+
+			if (php_openssl_matches_san_list(peer, peer_name, &has_service_id)) {
 				return SUCCESS;
+			} else if (has_service_id) {
+				/* CN must be ignored if the certificate presents a service identity. */
+				php_error_docref(NULL, E_WARNING,
+					"Peer certificate subjectAltName did not match expected name `%s'",
+					peer_name);
+				return FAILURE;
 			} else if (php_openssl_matches_common_name(peer, peer_name)) {
 				return SUCCESS;
 			} else {