Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.
Recommended action: Upgrade to 2.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact NVFLARE contains a vulnerability where deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity. All versions before 2.1.4 are affected. CVSS Score = 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Patches The patch is included in nvflare==2.1.4 This new version uses MessagePack instead of Pickle to do serialization and deserialization. Some object serializations supported by Pickle are not supported by MessagePack. We have provided out of box support for some built-in NVFLARE objects. For object serializations unsupported by MessagePack, the user will need to convert the objects to numpy or bytes before sending over to remote machines. The list of supported object types are listed in https://github.com/NVIDIA/NVFlare/blob/2.1/nvflare/fuel/utils/fobs/README.rst Workarounds No workarounds available. Additional information Issue Found by: Oliver…
Recommended action: Upgrade to 2.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact NVFLARE contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safeload(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity. All versions before 2.1.2 are affected. CVSS Score = 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Patches The patch will be included in nvflare==2.1.2 Workarounds Change yaml.load() to yaml.safeload() Additional information Issue Found by: Oliver Sellwood (@Nintorac)
Recommended action: Upgrade to 2.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact NVFLARE contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity. All versions before 2.1.2 are affected. CVSS Score = 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Patches The patch will be included in nvflare==2.1.2 Workarounds Replace pickle serialization with JSON and change the code accordingly Additional information Issue Found by: Oliver Sellwood (@Nintorac)
Recommended action: Upgrade to 2.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact NVIDIA FLARE contains a vulnerability in Admin Interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable All versions before 2.0.16 are affected. Patches The patch will be included in nvflare==2.0.16. Workarounds The changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e and https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e can be applied to any version of the NVIDIA FLARE without any adverse effect. Additional information Issue Found on: 2022.3.3 Issue Found by: Oliver Sellwood (@Nintorac)
Recommended action: Upgrade to 2.0.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.