Security Bulletin: NVIDIA NeMo - October 2024

NVIDIA has released a software update for NVIDIA® NeMo. To protect your system, download and install this software update from the Releases tab on the NeMo Github page. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update...

PT-2024-7979 · Nvidia · Nvidia Nemo

Name of the Vulnerable Software and Affected Versions: NVIDIA NeMo versions up to r2.0.0rc0 Description: The issue is related to the SaveRestoreConnector function in NVIDIA NeMo, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this...

Malicious code in @diotoborg/nemo-reprehenderit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4dc1bc1c432934e97b6a1fd2e19453c9d2381b91ab862b179dc8b24492333a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/nemo-voluptatibus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8745d1330fe8b20f8a676f1d834b53d6ad43ebb059d9c96d94acd7ab78dadb6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8456 Malicious code in @diotoborg/nemo-voluptatibus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8745d1330fe8b20f8a676f1d834b53d6ad43ebb059d9c96d94acd7ab78dadb6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/natus-similique-nemo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08ea3a0d44af0ce80a8be779e4d5d744999674e21b1ae58416f3a682574478c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/totam-nemo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd88f8d859a39bf19875ed8405b9250aa13c5c21b3f1cca74834d9090172aed9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/nemo-tenetur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41edbd03c6d4329bed5847f9b7b947f9220ea54a02ba2b59c008f835a1118a25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7288 Malicious code in @zitterorg/nemo-dolorem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73e8836ca27430f8ae61329ae104178b492bc3a1b9a6fa5d10ed3821f0013927 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/nemo-dolorem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73e8836ca27430f8ae61329ae104178b492bc3a1b9a6fa5d10ed3821f0013927 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7286 Malicious code in @zitterorg/nemo-atque (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d9c1da21e7f18856e39379c221e5cc6b4d82f0d1ff647120db0b4e5a4396d5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/placeat-nemo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d530c8423e4aaf2b74b746404a5667c393703ad6c4c4f20762badfbe9ab64269 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/nemo-distinctio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bb53da9b0e4f4835fd7e784ca3721e5e63d4194a150bb48d3ff7765638de927 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OPENSUSE-SU-2024:12898-1 nemo-extension-warpinator-1.6.1-1.1 on GA media

These are all security issues fixed in the nemo-extension-warpinator-1.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2024-1419 Malicious code in @juiggitea/cumque-nemo-quod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a49efbe4e4279004e06685e2e27c50cf89e331267488d97cd6b492fa39fcca99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-0081

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asrwebapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service...

PYSEC-2024-289

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asrwebapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service...

PYSEC-2024-289

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asrwebapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service...

CVE-2024-0081

CVE-2024-0081 affects NVIDIA NeMo framework for Ubuntu, specifically the tools/asr_webapp component. The root cause is an improper/resource-allocation control that allows an attacker to cause unbounded allocation of resources, leading to server-side denial of service. Multiple connected sources c...

CVE-2024-0081

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asrwebapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service...