by Kastro
Paper/Archive/CVE-2022-34668

CVE-2022-34668

NVIDIA NVIDIA FLARE — NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unpriv…

EPSS 12%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.0.960 × 2019.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

Affected

ProductAffectedFixed inSource
NVIDIA FLAREAll versions prior to 2.1.4–CNA

Scores by source

nvidia (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6refpacketstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html