PT-2025-38258 · Dragonfly · Dragonfly

Gaius-Qi · Published 2025-09-17 · Updated 2025-10-27 · CVE-2025-59347

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0

Description Dragonfly, an open source P2P-based file distribution and image acceleration system, disables TLS certificate verification in its HTTP clients. These clients are not configurable, preventing users from re-enabling verification. An attacker can perform a Man-in-the-Middle attack, providing invalid data to the Manager, leading to preheating with incorrect data, resulting in denial of service and file integrity issues. The vulnerable code snippet involves the getAuthToken function and the TLSClientConfig within the http.Transport, where InsecureSkipVerify is set to true.

Recommendations Upgrade to version 2.1.0 or later.

Exploit

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

CVE-2025-59347

GHSA-98X5-JW98-6C97

GO-2025-3966

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Dragonfly

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59347.json · Exploit
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-98x5-jw98-6c97 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3966 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-98x5-jw98-6c97 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59347 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://github.com/dragonflyoss/dragonfly · Note
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note
• https://suse.com/security/cve/CVE-2025-59348 · Note
• https://suse.com/security/cve/CVE-2025-47910 · Note
• https://suse.com/security/cve/CVE-2025-23267 · Note