PT-2025-38261 · Dragonfly · Dragonfly

Gaius-Qi · Published 2025-09-17 · Updated 2025-10-27 · CVE-2025-59350

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0

Description The access control mechanism for the Proxy feature uses simple string comparisons and is vulnerable to timing attacks. An attacker may attempt to guess the password character by character by sending possible characters to the vulnerable mechanism and measuring the comparison instruction’s execution times. The vulnerable code performs a short-circuiting equality operation to compare the username and password. The potential impact of successful exploitation is currently undetermined.

Recommendations Upgrade to version 2.1.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-208

CWE-697

Related Identifiers

CVE-2025-59350

GHSA-C2FC-9Q9C-5486

GO-2025-3972

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Dragonfly

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59350.json · Exploit
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-c2fc-9q9c-5486 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59350 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59350 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2fc-9q9c-5486 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://github.com/dragonflyoss/dragonfly · Note
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf · Note
• https://suse.com/security/cve/CVE-2025-59350 · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2025-23266 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note
• https://suse.com/security/cve/CVE-2025-59348 · Note