CVE-2022-34668

Advisory

Nvflare 2.1.4 includes a fix for CVE-2022-34668: Deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://nvd.nist.gov/vuln/detail/CVE-2022-34668
• https://github.com/advisories/GHSA-6qv6-q77g-7qm6
• https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34668
• http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html