Vulnerability · Published Jul 1, 2022 · Assigned by nvidia
CVE-2022-31604
Critical 9.8
In plain English
A critical-severity unsafe deserialization in NVIDIA FLARE from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | nvflare | 2.1.2 | GHSA-rcxc-3w2m-mp8h |
| PyPI | nvflare | 2.1.2 | PYSEC-2022-231 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NVIDIA | NVIDIA FLARE | All versions prior to 2.1.2 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H