PT-2025-38272 · Dragonfly · Dragonfly

Gaius-Qi · Published 2025-09-17 · Updated 2025-10-27 · CVE-2025-59353

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0

Description A peer can obtain a valid TLS certificate for arbitrary IP addresses, rendering the mTLS authentication ineffective. The Manager’s Certificate gRPC service does not validate if the requested IP addresses belong to the peer requesting the certificate. The vulnerable code parses a certificate signing request (CSR) and does not verify that the IP addresses within the CSR match the peer’s connection IP address.

Recommendations Upgrade to version 2.1.0 or later.

Exploit

Fix

Missing Authorization

Improper Certificate Validation

Weakness Enumeration

CWE-862

CWE-295

Related Identifiers

CVE-2025-59353

GHSA-255V-QV84-29P5

GO-2025-3969

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Dragonfly

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59353.json · Exploit
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-255v-qv84-29p5 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59353 · Security Note
• https://osv.dev/vulnerability/GHSA-255v-qv84-29p5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59353 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3969 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://github.com/dragonflyoss/dragonfly · Note
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf · Note
• https://suse.com/security/cve/CVE-2025-59350 · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2025-23266 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note
• https://suse.com/security/cve/CVE-2025-59348 · Note