Vulnerability · Published May 31, 2024 · Assigned by mitre
CVE-2024-37032
High 8.8
In plain English
A high-severity path traversal in the github.com/ollama/ollama package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 89.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ollama/ollama | 0.1.34 | GHSA-8hqg-whrw-pv92 |
| Go | github.com/ollama/ollama | 0.1.34 | GO-2024-2901 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/ollama/ollama/pull/4175
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032