Home » Database

AVID-2026-R1055

Description

Vulnerability CVE-2022-34668

Details

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

Reason for inclusion in AVID: CVE-2022-34668 concerns NVFlare, an AI/ML software framework used to build/deploy AI systems; the vulnerability is a deserialization (Pickle) issue enabling remote code execution, denial of service, and impacts to confidentiality and integrity within the AI software stack. This affects components in the AI supply chain (deployment/runtime of AI workloads) and is a security vulnerability with clear AI relevance.

References

Affected or Relevant Artifacts

  • Developer: NVIDIA
  • Deployer: NVIDIA
  • Artifact Details:
TypeName
SystemNVIDIA FLARE

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score9.8
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-502CWE-502: Deserialization of Untrusted Data

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2022-08-29
  • Version: 0.3.3
  • AVID Entry