Deserialization Flaw in NVFLARE by NVIDIA

CVE-2022-31605

Summary

The NVFLARE product by NVIDIA, prior to version 2.1.2, features a vulnerability in its utils module. This flaw arises from the use of yaml.load() instead of the safer yaml.safe_load() for loading YAML files. An unprivileged network attacker can exploit this weakness, potentially resulting in remote code execution, denial of service, and detrimental impacts on data confidentiality and integrity.

References