Skip to content

Ollama does not validate the format of the digest (sha256 with 64 hex digits)

Moderate severity GitHub Reviewed Published May 31, 2024 to the GitHub Advisory Database • Updated Sep 6, 2024

Package

gomod github.com/ollama/ollama (Go)

Affected versions

< 0.1.34

Patched versions

0.1.34

Description

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

References

Published by the National Vulnerability Database May 31, 2024
Published to the GitHub Advisory Database May 31, 2024
Reviewed Jun 2, 2024
Last updated Sep 6, 2024

Severity

Moderate

EPSS score

0.066%
(30th percentile)

Weaknesses

No CWEs

CVE ID

CVE-2024-37032

GHSA ID

GHSA-8hqg-whrw-pv92

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.