CVE-2025-68637

Katalog CVE

CVSS 9.1 · Critical EPSS 0,25%

Kerentanan Improper Validation of Certificate with Host Mismatch pada apache uniffle. Skor CVSS 3.1 9.1 (Critical) menurut CISA ADP.

Deskripsi (NVD)

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-297: Improper Validation of Certificate with Host Mismatch

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v issue tracking · mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/12/27/2 mailing list · advisory pihak ketiga