CVE-2022-31605: NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The…

critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
nvidia	nvflare	< 2.1.2	2.1.2
nvidia	nvflare	>= 0 < 2.1.2	2.1.2
nvidia	nvidia_flare	—	—