Vulnerability Report: GO-2024-2901
- CVE-2024-37032, GHSA-8hqg-whrw-pv92
- Affects: github.com/ollama/ollama
- Published: Jun 14, 2024
- Modified: Dec 12, 2024
Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama
For detailed information about this vulnerability, visit https://github.com/advisories/GHSA-8hqg-whrw-pv92.
Affected Packages
-
PathGo VersionsSymbols
-
before v0.1.34
Aliases
References
- https://github.com/advisories/GHSA-8hqg-whrw-pv92
- https://github.com/ollama/ollama/commit/2a21363bb756a7341d3d577f098583865bd7603f
- https://github.com/ollama/ollama/pull/4175
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032
- https://vuln.go.dev/ID/GO-2024-2901.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.