CVE-2025-59353: Github.com/dragonflyoss/dragonfly DragonFly's Manager Generates MTLS Certificates Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-255v-qv84-29p5",
  "modified" : "2025-09-26T16:19:18Z",
  "published" : "2025-09-17T20:11:37Z",
  "aliases" : [ "CVE-2025-59353" ],
  "summary" : "DragonFly's manager generates mTLS certificates for arbitrary IP addresses",
  "details" : "### Impact\nA peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request.\n\n```golang\nif addr, ok := p.Addr.(*net.TCPAddr); ok {\n       ip = addr.IP.String()\n} else {\n       ip, _, err = net.SplitHostPort(p.Addr.String())\n       if err != nil {\n             return nil, err\n       }\n}\n// Parse csr.\n[skipped]\n// Check csr signature.\n// TODO check csr common name and so on.\nif err = csr.CheckSignature(); err != nil {\n       return nil, err\n}\n[skipped]\n// TODO only valid for peer ip\n// BTW we need support both of ipv4 and ipv6.\nips := csr.IPAddresses\nif len(ips) == 0 {\n       // Add default connected ip.\n       ips = []net.IP{net.ParseIP(ip)}\n}\n```\n### Patches\n\n- Dragonfy v2.1.0 and above.\n\n### Workarounds\n\nThere are no effective workarounds, beyond upgrading.\n\n### References\n\nA third party security audit was performed by Trail of Bits, you can see the [full report](https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf).\n\nIf you have any questions or comments about this advisory, please email us at [dragonfly-maintainers@googlegroups.com](mailto:dragonfly-maintainers@googlegroups.com).",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/dragonflyoss/dragonfly"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "d7y.io/dragonfly/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-255v-qv84-29p5"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59353"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dragonflyoss/dragonfly"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf"
  }, {
    "type" : "WEB",
    "url" : "https://pkg.go.dev/vuln/GO-2025-3969"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-295" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-17T20:11:37Z",
    "nvd_published_at" : "2025-09-17T20:15:37Z"
  }
}