Vulnerability · Published Aug 29, 2022 · Assigned by nvidia
CVE-2022-34668
Critical 9.8
In plain English
A critical-severity unsafe deserialization in NVIDIA FLARE from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.6% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)11.6%top 3.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | nvflare | 2.1.4 | GHSA-6qv6-q77g-7qm6 |
| PyPI | nvflare | 2.1.4 | PYSEC-2022-257 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NVIDIA | NVIDIA FLARE | All versions prior to 2.1.4 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H