CVE-2022-31605: Unsafe YAML Deserialization in NVFlare
Summary
CVE-2022-31605: Unsafe yaml deserialization in NVFlare. Affects nvflare versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NVFlare is a package available on PyPI that provides utilities for working with YAML files. It is used to load and process YAML data in various applications. However, prior to version 2.1.2, NVFlare contained a vulnerability in its utils module. The vulnerability arises from the use of the unsafe yaml.load() function instead of the safer yaml.safe_load(). This allows for the deserialization of untrusted data, potentially leading to remote code execution, denial of service, and compromising the confidentiality and integrity of the system.
Vulnerability Detail
The vulnerability in NVFlare arises from the insecure deserialization of YAML files using yaml.load(). This can be exploited by an unprivileged network attacker to execute arbitrary code, disrupt the normal functioning of the system, and compromise the confidentiality and integrity of the data. The vulnerability has a CVSS score of 9.8, indicating its critical severity. It affects all versions of NVFlare prior to 2.1.2.
How To Fix
Minimum fixed version
2.1.2
This is the first release that contains the fix.
pip install --upgrade "nvflare==2.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the patched version is not immediately possible, a temporary workaround is to replace the usage of yaml.load() with yaml.safe_load() in the affected functions, specifically nvflare.lighter.provision.main and nvflare.lighter.utils.load_yaml. This change ensures that only safe deserialization is performed, mitigating the risk of code execution through malicious YAML data.
Conclusion
The vulnerability in NVFlare's utils module allows for unsafe YAML deserialization, which can lead to remote code execution and compromise the system's confidentiality and integrity. It is crucial to update NVFlare to version 2.1.2 or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nvflare →
FAQ
NVFlare is a package available on PyPI that provides utilities for working with YAML files. It is commonly used in applications that require parsing and processing of YAML data.
The vulnerability allows for the deserialization of untrusted data, which can be exploited by an attacker to execute arbitrary code, disrupt the system, and compromise the confidentiality and integrity of the data.
All versions of NVFlare prior to 2.1.2 are affected by this vulnerability.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix the vulnerability, update NVFlare to version 2.1.2 or later. This version includes a patch that addresses the insecure deserialization issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for nvflare.
