CVE-2022-31604

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-31604

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31604.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-31604

Aliases

Published

2022-07-01T17:15:21Z

Modified

2026-07-15T01:48:55.714437032Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "nvidia",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31604.json"
}

References

Affected packages

Git / github.com/nvidia/nvflare

Affected ranges

Type

GIT

Repo

https://github.com/nvidia/nvflare

Events

Introduced

2b6e1b1e2e0da8636e636289e92266c42e3e6483

Fixed

2b6e1b1e2e0da8636e636289e92266c42e3e6483

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "All versions prior to 2.1.2"
        },
        {
            "last_affected": "All versions prior to 2.1.2"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.2"
        }
    ],
    "cpe": "cpe:2.3:a:nvidia:nvflare:*:*:*:*:*:*:*:*"
}

Affected versions

All versions prior to 2.*

All versions prior to 2.1.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31604.json"