Deserialization Of Untrusted Data

2022-06-2311:31:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

nvflare

vulnerability

untrusted data

deserialization

ca credentials

pickle

attacker

code execution

application crash

software

EPSS

0.003

Percentile

71.7%

JSON

nvflare is vulnerable to deserialization of untrusted data. The vulnerability exists because the CA credentials are transported via pickle and not properly deserialized which allows an attacker to execute codes and cause an application crash.

References

github.com/advisories/GHSA-rcxc-3w2m-mp8h

github.com/NVIDIA/NVFlare/commit/8e0996b70b72c76d2c9d5528c1fd435c4b89f59f

github.com/NVIDIA/NVFlare/releases/tag/2.1.2

github.com/NVIDIA/NVFlare/security/advisories/GHSA-rcxc-3w2m-mp8h

EPSS

0.003

Percentile

71.7%

JSON

Related for VERACODE:36096