PT-2022-22281 · Nvflare · Nvflare

Elias Hohl + 1 · Published 2022-08-29 · Updated 2023-03-27 · CVE-2022-34668

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVFLARE versions prior to 2.1.4

Description The issue concerns deserialization of untrusted data due to Pickle usage, which may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and impact both Confidentiality and Integrity.

Recommendations For versions prior to 2.1.4, update to version 2.1.4, which uses MessagePack instead of Pickle for serialization and deserialization. Note that some object serializations supported by Pickle are not supported by MessagePack, so users may need to convert objects to numpy or bytes before sending them to remote machines. Refer to the list of supported object types for more information.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-34668

GHSA-6QV6-Q77G-7QM6

PYSEC-2022-257

Affected Products

Nvflare

References · 11

• 🔥 https://exploit-db.com/exploits/51051 · Exploit
• https://osv.dev/vulnerability/GHSA-6qv6-q77g-7qm6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34668 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-257 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34668 · Vendor Advisory
• https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6 · Note
• https://github.com/NVIDIA/NVFlare/commit/6cde16f3f4711583ae4d896dfcc125d25c7d5b0d · Note
• https://github.com/NVIDIA/NVFlare · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nvflare/PYSEC-2022-257.yaml · Note
• http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html · Note
• https://t.me/cibsecurity/48956 · Telegram Post