Security Flaw in NVFLARE's PKI Module by NVIDIA

CVE-2022-31604

Summary

NVFLARE, developed by NVIDIA, has a vulnerability in its PKI implementation module affecting versions prior to 2.1.2. The flaw arises from the insecure handling of CA credentials, which are serialized using Python's pickle module. This mechanism lacks proper safe deserialization, allowing an unprivileged network attacker to exploit the system. Successful exploitation can lead to remote code execution, resulting in denial of service and potentially compromising the confidentiality and integrity of sensitive data.

References