Remote Code Execution Vulnerability in NVFLARE by NVIDIA
CVE-2022-34668

9.8CRITICAL

Key Information:

Vendor
Nvidia
Status
Nvidia Flare
Vendor
CVE Published:
29 August 2022

Summary

NVIDIA's NVFLARE prior to version 2.1.4 is susceptible to a vulnerability that stems from unsafe deserialization practices involving the Pickle module. This flaw allows an unprivileged network attacker to exploit the system, potentially leading to remote code execution or denial of service. The breach may compromise the confidentiality and integrity of sensitive data, posing severe risks to affected users.

Affected Version(s)

NVIDIA FLARE All versions prior to 2.1.4

References

https://github.com/NVIDIA/NVFlare/security/advisories/GHS...
http://packetstormsecurity.com/files/171483/NVFLARE-Unsaf...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.