CVE-2022-34668
critical · 9.8NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
9.8
CVSS
11.6%
EPSS (exploit prob.)
96th
EPSS percentile
2022-08-29
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| nvidia | nvflare | < 2.1.4 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html
- https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6
- http://packetstormsecurity.com/files/171483/NVFLARE-Unsafe-Deserialization.html
- https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-34668