CVE-2022-34668 in the critical feed json
NVFLARE unsafe deserialization due to Pickle
published 2022-08-29 4 y ago modified 2026-07-08 4 mo ago also GHSA-6qv6-q77g-7qm6 , PYSEC-2022-257 , EUVD-2022-0168
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 11.6%
- EPSS 11.6% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Patch / fix
Timeline
- Published
- First public exploit (EDB-51051)
Exploit prediction
11.61% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-51051 NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle remote, 2023-03-25
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nvflare | <2.1.4 |
2.1.4 |
Affected products
- NVIDIA NVIDIA FLARE
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/NVIDIA/NVFlare/commit/6cde16f3f4711583ae4d896dfcc125d25c7d5b0d
web
-
github.com
/NVIDIA/NVFlare/security/advisories/GHSA-6qv6-q77g-7qm6
web, third-party-advisory, advisory
-
packetstormsecurity.com
/files/171483/NVFLARE-Unsafe-Deserialization.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-34668
advisory
-
github.com
/NVIDIA/NVFlare
package
-
github.com
/pypa/advisory-database/tree/main/vulns/nvflare/PYSEC-2022-257.yaml
web
Sources
- CVE List CVE-2022-34668
- GitHub Advisory GHSA-6qv6-q77g-7qm6
- NVD CVE-2022-34668
- OSV PYSEC-2022-257
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.