CVE-2022-31604
published 2022-07-01CVE-2022-31604: NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.93%
77.7th percentile
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nvidia | nvflare | < 2.1.2 | 2.1.2 |
| nvidia | nvflare | >= 0 < 2.1.2 | 2.1.2 |
| nvidia | nvidia_flare | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-31604: NVFLARE, versions prior to 2
osv·2022-07-01
CVE-2022-31604 CVE-2022-31604: NVFLARE, versions prior to 2
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
GHSA
Unsafe deserialisation in the PKI implementation scheme of NVFlare
ghsa·2022-06-22
CVE-2022-31604 [CRITICAL] CWE-502 Unsafe deserialisation in the PKI implementation scheme of NVFlare
Unsafe deserialisation in the PKI implementation scheme of NVFlare
### Impact
NVFLARE contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
All versions before 2.1.2 are affected.
CVSS Score = 9.8
[AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln-metrics%2Fcvss%2Fv3-calculator%3Fvector%3DAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH&data=05%7C01%7Cchesterc%40nvidia.com%7Ce9600bde16854b0b380008da4fc544f7%7C43083d15727340c1b7db39efd9c
OSV
Unsafe deserialisation in the PKI implementation scheme of NVFlare
osv·2022-06-22
CVE-2022-31604 [CRITICAL] Unsafe deserialisation in the PKI implementation scheme of NVFlare
Unsafe deserialisation in the PKI implementation scheme of NVFlare
### Impact
NVFLARE contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
All versions before 2.1.2 are affected.
CVSS Score = 9.8
[AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln-metrics%2Fcvss%2Fv3-calculator%3Fvector%3DAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH&data=05%7C01%7Cchesterc%40nvidia.com%7Ce9600bde16854b0b380008da4fc544f7%7C43083d15727340c1b7db39efd9c
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-01
Published