Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dragonfly Manager makes requests to external endpoints with disabled TLS authentication
Vulnerability Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat jobs. An adversary performs a network-level Man-in-the-Middle attack, providing invalid data to the Manager. The Manager preheats with the wrong data, which later causes a denial of service and file integrity problems. This vulnerability is fixed in 2.1.0.
CVSS Information
N/A
Vulnerability Type
证书验证不恰当
Vulnerability Title
Dragonfly 信任管理问题漏洞
Vulnerability Description
Dragonfly是DragonflyDB开源的一个框架，可以对任何内容类型进行动态处理。 Dragonfly 2.1.0之前版本存在信任管理问题漏洞，该漏洞源于禁用TLS证书验证，可能导致中间人攻击和拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A