CVE-2022-31604

CWE-502 — Deserialization of Untrusted Data5 documents4 sources
Severity
9.8CRITICAL
EPSS
2.4%
top 14.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia NvflareNvidia Nvidia Flare
Timeline
PublishedJul 1

Description

NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶PyPInvflare< 2.1.2
▶NVDnvidia/nvflare< 2.1.2
▶CVEListV5nvidia/nvidia_flareAll versions prior to 2.1.2

🔴Vulnerability Details

4
CVEList
CVE-2022-31604: NVFLARE, versions prior to 2↗2022-07-01
▶
OSV
CVE-2022-31604: NVFLARE, versions prior to 2↗2022-07-01
▶
GHSA
Unsafe deserialisation in the PKI implementation scheme of NVFlare↗2022-06-22
▶
OSV
Unsafe deserialisation in the PKI implementation scheme of NVFlare↗2022-06-22
▶