CRITICAL🇵🇱 Wersja polska

CVE-2025-68637

CVSS 9.1v3.1pub. 2026-01-07upd. 2026-01-16

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

🤖 AI Analysis
How it works

The HTTP client in Apache Uniffle is configured to accept any SSL certificate without verifying its validity and without checking whether the hostname in the certificate matches the target server (CWE-297: Improper Validation of Certificate with Host Mismatch). This means that an attacker located on the network path between the Uniffle CLI/client and the Uniffle Coordinator service can substitute their own certificate and intercept or modify REST API traffic. Since SSL verification is disabled by default, the attack is possible without any additional configuration on the victim's side.

Impact

An attacker can intercept and modify all REST API communication between the Uniffle client and the Coordinator service, leading to violation of confidentiality and integrity of transmitted data.

Mitigation & patch

Apache Uniffle should be updated to version 0.10.0 or later, which resolves the issue through proper SSL certificate and hostname verification.

Who is affected

All Apache Uniffle versions before 0.10.0

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • Apache Uniffle

    APP
    Apache
    < 0.10.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-24813CRITICAL9.8⚠ KEVPL ✓same vendor

Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych

CVE-2024-38856CRITICAL9.8⚠ KEVPL ✓same vendor

Apache OFBiz — nieautoryzowane wykonanie kodu przez błędną autoryzację

CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓same vendor

Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie

CVE-2024-32113CRITICAL9.8⚠ KEVPL ✓same vendor

Path Traversal w Apache OFBiz umożliwiający zdalne wykonanie kodu

CVE-2024-27348CRITICAL9.8⚠ KEVPL ✓same vendor

RCE w Apache HugeGraph-Server — zdalne wykonanie poleceń bez uwierzytelnienia