CVEvulnerability
CVE-2022-34668
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-08-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
Description
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Affected configurations
• nvidia nvflare (< 2.1.4)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html packetstormsecurity.com
- https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6 Third Party Advisory
- http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html packetstormsecurity.com
- https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6 Third Party Advisory