Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama
Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-37032US | — | Exploit | ||
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-8hqg-whrw-pv92ADVISORY
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58WEB
- https://github.com/ollama/ollama/commit/2a21363bb756a7341d3d577f098583865bd7603fFIX
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34WEB
- https://github.com/ollama/ollama/pull/4175FIX
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan