GitHub Advisoryadvisory · PyPI

GHSA-jx8f-cpx7-fv47 Allocation of Resources Without Limits or Throttling in nvflare

HIGH Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-21822
Ecosystem
PyPI
Packages
nvflare
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2022-03-18

Affected packages

• PyPI nvflare: < 2.0.16 → fixed in 2.0.16

Description

Impact NVIDIA FLARE contains a vulnerability in Admin Interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable All versions before 2.0.16 are affected. Patches The patch will be included in nvflare==2.0.16. Workarounds The changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e and https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e can be applied to any version of the NVIDIA FLARE without any adverse effect. Additional information Issue Found on: 2022.3.3 Issue Found by: Oliver Sellwood (@Nintorac)

Related

Alias · CVE (1)

  • CVE-2022-21822 NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References