Nintorac

**Name of the Vulnerable Software and Affected Versions** calamares-nixos-extensions versions prior to 0.3.17 **Description** The issue affects users who installed NixOS through the graphical installer using manual disk partitioning, where the system boots via legacy BIOS, some disk partitions are encrypted, but the partitions containing `/` or `/boot` are unencrypted. The LUKS disk encryption key file is stored in plain text in `/crypto keyfile.bin` or in a CPIO archive attached to the NixOS initrd. This problem is a partial regression of a previous issue and affects the security of the system. The estimated number of potentially affected devices is not specified. **Recommendations** For calamares-nixos-extensions versions prior to 0.3.17, the best solution is to back up data and perform a complete reinstallation. As a temporary workaround, consider deleting the `/crypto keyfile.bin` file and following the remediation steps for the previous advisory, especially if `/` is unencrypted but `/boot` is not. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `crypto keyfile.bin` file in the affected setup until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** NVFLARE versions prior to 2.1.2 **Description** The issue is related to NVFLARE's PKI implementation module, where CA credentials are transported via pickle without safe deserialization. This may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and impact both Confidentiality and Integrity. **Recommendations** For versions prior to 2.1.2, update to version 2.1.2 to resolve the issue. As a temporary workaround, consider replacing pickle serialization with JSON and changing the code accordingly to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NVFLARE versions prior to 2.1.2 **Description** The issue concerns the deserialization of untrusted data in the utils module of NVFLARE, where YAML files are loaded via `yaml.load()` instead of `yaml.safe load()`. This may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and impact both Confidentiality and Integrity. **Recommendations** For versions prior to 2.1.2, update to version 2.1.2 to resolve the issue. As a temporary workaround, consider changing `yaml.load()` to `yaml.safe load()` in the affected module.

**Name of the Vulnerable Software and Affected Versions** NVIDIA FLARE versions prior to 2.0.16 **Description** The issue is related to the admin interface of NVIDIA FLARE, where an unauthorized attacker can cause allocation of resources without limits or throttling, potentially leading to system unavailability. **Recommendations** For versions prior to 2.0.16, update to version 2.0.16 to resolve the issue. As a temporary workaround, apply the changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e to any version of NVIDIA FLARE without adverse effects.