GHSA-255v-qv84-29p5

Опубликовано: 17 сент. 2025

Источник: github

Github: Прошло ревью

CVSS4: 7.7

Описание

DragonFly's manager generates mTLS certificates for arbitrary IP addresses

Impact

A peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request.

if addr, ok := p.Addr.(*net.TCPAddr); ok { ip = addr.IP.String() } else { ip, _, err = net.SplitHostPort(p.Addr.String()) if err != nil { return nil, err } } // Parse csr. [skipped] // Check csr signature. // TODO check csr common name and so on. if err = csr.CheckSignature(); err != nil { return nil, err } [skipped] // TODO only valid for peer ip // BTW we need support both of ipv4 and ipv6. ips := csr.IPAddresses if len(ips) == 0 { // Add default connected ip. ips = []net.IP{net.ParseIP(ip)} }

Patches

Dragonfy v2.1.0 and above.

Workarounds

There are no effective workarounds, beyond upgrading.

References

A third party security audit was performed by Trail of Bits, you can see the full report.

If you have any questions or comments about this advisory, please email us at dragonfly-maintainers@googlegroups.com.

Ссылки

Пакеты

Наименование

github.com/dragonflyoss/dragonfly

Затронутые версииВерсия исправления

< 2.1.0

2.1.0

Наименование

d7y.io/dragonfly/v2

Затронутые версииВерсия исправления

< 2.1.0

2.1.0

EPSS

Процентиль: 19%

0.00059

Низкий

7.7 High

CVSS4

CVE ID

CVE-2025-59353

Дефекты

CWE-295

Связанные уязвимости

CVE-2025-59353

CVSS3: 7.5

nvd

5 месяцев назад

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.

EPSS

Процентиль: 19%

0.00059

Низкий

7.7 High

CVSS4

CVE ID

CVE-2025-59353

Дефекты

CWE-295