Race Condition Affecting nvflare package, versions [,2.4.2) [2.5.0rc1,2.5.0rc2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-NVFLARE-7856156
- published 2 Sep 2024
- disclosed 1 Sep 2024
- credit Unknown
How to fix?
Upgrade nvflare to version 2.4.2, 2.5.0rc2 or higher.
Overview
nvflare is a Federated Learning Application Runtime Environment
Affected versions of this package are vulnerable to Race Condition in utils/pipe/pipe_handler.py, where an attacker can cause the self.pipe object to be set to None during execution, triggering a crash.