PT-2025-38273 · Dragonfly · Dragonfly

Gaius-Qi · Published 2025-09-17 · Updated 2025-10-27 · CVE-2025-59354

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0

Description Dragonfly2 uses the MD5 hash function for downloaded files, which does not provide collision resistance. This allows attackers to replace files with malicious ones that have a colliding hash. An attacker, such as Alice, can create an innocent image and a malicious image with colliding MD5 hashes. Bob may unintentionally use the malicious image after downloading it from the peer-to-peer network. The vulnerability is due to the use of the MD5 hash function in the pieceDigests variable and the subsequent comparison with t.PieceMd5Sign.

Recommendations Upgrade to version 2.1.0 or above.

Exploit

Fix

Weakness Enumeration

CWE-328

Related Identifiers

CVE-2025-59354

GHSA-HX2H-VJW2-8R54

GO-2025-3973

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Dragonfly

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59354.json · Exploit
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-hx2h-vjw2-8r54 · Patch
• https://osv.dev/vulnerability/GO-2025-3973 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hx2h-vjw2-8r54 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59354 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59354 · Security Note
• https://github.com/dragonflyoss/dragonfly · Note
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note
• https://suse.com/security/cve/CVE-2025-59348 · Note
• https://suse.com/security/cve/CVE-2025-47910 · Note
• https://suse.com/security/cve/CVE-2025-23267 · Note