CVE-2025-68637

CRITICAL

9.1

Beschreibung

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

CVE Details

CVSS v3.1 Bewertung9.1

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht1/7/2026

Zuletzt geandert1/16/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

apache:uniffle

Schwachen (CWE)

CWE-297

Referenzen

https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v(security@apache.org)

http://www.openwall.com/lists/oss-security/2025/12/27/2(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.