CVE-2022-34668: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

August 29, 2022 (updated March 27, 2023)

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

References

github.com/NVIDIA/NVFlare/commit/6cde16f3f4711583ae4d896dfcc125d25c7d5b0d
github.com/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6
github.com/advisories/GHSA-6qv6-q77g-7qm6
nvd.nist.gov/vuln/detail/CVE-2022-34668

Code Behaviors & Features

Detect and mitigate CVE-2022-34668 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →