NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction.
Date: 2024-10
Affected: nvidia/nemo, apple/macos, linux/linux_kernel, microsoft/windows
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-0129
CWE: CWE-22
CVSS: 6.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering.


Mitigations:

Architectural layers (MAESTRO):