by Kastro
Paper/Archive/CVE-2025-68637

CVE-2025-68637

Apache Software Foundation Apache Uniffle — Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 16.8.168 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

Affected

ProductAffectedFixed inSource
Apache Uniffle< 0.10.00.10.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2vrefopenwall.com/lists/oss-security/2025/12/27/2