CVE-2025-68637: Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client
The Uniffle HTTP client is configured to trust all SSL certificates and
disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.
This issue affects all versions from before 0.10.0.
Users are recommended to upgrade to version 0.10.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Uniffleto a version that resolves this vulnerability.Fixed in 0.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68637?
CVE-2025-68637 is considered a high severity vulnerability due to its potential for Man-in-the-Middle (MITM) attacks.
How do I fix CVE-2025-68637?
To fix CVE-2025-68637, configure the Uniffle HTTP client to verify SSL certificates and enable hostname verification.
What are the potential impacts of CVE-2025-68637?
The potential impacts of CVE-2025-68637 include unauthorized access to sensitive data and disruption of communication due to MITM attacks.
Which versions of Uniffle are affected by CVE-2025-68637?
CVE-2025-68637 affects Uniffle versions prior to 0.10.0.
Is there a workaround for CVE-2025-68637?
A temporary workaround for CVE-2025-68637 is to manually configure SSL verification in your Uniffle client settings until an official patch is applied.