Vulnerability · Published Jul 1, 2022 · Assigned by nvidia

CVE-2022-31605

Critical 9.8

In plain English

A critical-severity unsafe deserialization in NVIDIA FLARE from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.1%top 18.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	nvflare	2.1.2	GHSA-hrf3-622q-8366
PyPI	nvflare	2.1.2	PYSEC-2022-232

Affected products (as reported)

Vendor	Product	Versions
NVIDIA	NVIDIA FLARE	All versions prior to 2.1.2

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-hrf3-622q-8366 x_refsource_MISC