NVIDIA FLARE SDK FOBS Deserialization Vulnerability Leading to Code Execution

A vulnerability exists in the NVIDIA FLARE SDK prior to version 2.7.2, specifically within the FOBS component. This vulnerability allows an attacker to cause deserialization of untrusted data by sending a malicious FOBS-encoded message. Exploiting this vulnerability could result in unauthorized code execution.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the affected system.

Remediation

Users are advised to update to NVIDIA FLARE SDK version 2.7.2 or later. The updated version can be downloaded from the NVIDIA/NVFlare repository on GitHub.