PT-2026-1641 · Uniffle · Uniffle

Omkar Parkhe · Publicado 2026-01-07 · Atualizado 2026-02-15 · CVE-2025-68637

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Uniffle versions prior to 0.10.0

Description The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. The vulnerable component is the HTTP client. The affected API communication involves REST API endpoints.

Recommendations Upgrade to version 0.10.0.

Correção

Enumeração de Fraquezas

CWE-297

Identificadores relacionados

CVE-2025-68637

Produtos afetados

Uniffle

Referências · 10

• https://twitter.com/CVEnew/status/2008846155367518619 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68637 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-68637 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2008935718333350089 · Publicação no Twitter
• https://twitter.com/Komodosec/status/2022868527108231583 · Publicação no Twitter
• https://twitter.com/transilienceai/status/2022876203015864514 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2025/12/27/2 · Nota
• https://t.me/CVEtracker/41594 · Publicação no Telegram
• https://t.me/pentestingnews/72250 · Publicação no Telegram
• https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v · Aviso do Fabricante