Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

According to the self-reported version in its response header, the version of Ollama hosted on the remote web server is < 0.1.29. It is, therefore, affected by a DNS Rebinding.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the
    full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause
    a denial of service (resource exhaustion). (CVE-2024-28224)

The version of Ollama installed on the remote host is prior to 0.1.29. It is, therefore, affected by a DNS rebinding vulnerability. Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114580	Ollama < 0.1.29 DNS Rebinding	Web App Scanning	Component Vulnerability	medium
410906	SCA: security update for github.com/ollama/ollama (GHSA-5jx5-hqx5-2vrj)	Tenable Cloud Security	SCA Checks	medium
410906	SCA: security update for github.com/ollama/ollama (GHSA-5jx5-hqx5-2vrj)	Tenable Self-Hosted Container Security	SCA Checks	medium
200186	Ollama < 0.1.29 DNS Rebinding	Nessus	Artificial Intelligence	medium

Detections

Analytics

CVE-2024-28224

medium

Tenable Plugins

medium

medium

medium

medium