Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

According to the self-reported version in its response header, the version of Ollama hosted on the remote web server is < 0.1.34. It is, therefore, affected by a Multiples vulnerabilities :

- A Remote Code Execution through models pulling - An Improper Resource Shutdown or Release through the req.Path parameter which is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting
    the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more
    than 64 hex digits, or an initial ../ substring. (CVE-2024-37032)

The version of Ollama installed on the remote host is prior to 0.1.34. It is, therefore, affected by an improper input validation vulnerability. Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114579	Ollama < 0.1.34 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
412709	SCA: security update for github.com/ollama/ollama (GHSA-8hqg-whrw-pv92)	Tenable Cloud Security	SCA Checks	Local	high
412709	SCA: security update for github.com/ollama/ollama (GHSA-8hqg-whrw-pv92)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
200185	Ollama < 0.1.34 Improper Input Validation	Nessus	Artificial Intelligence	Local	high

Detections

Analytics

CVE-2024-37032

high

Tenable Plugins

high

high

high

high