NVFLARE, versions before 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network malicious user to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
nvidia nvflare |