CVE-2024-37032
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the…
High · published May 31, 2024
Patch now
High probability of exploitation
CVSS calls it high at 8.8. It sits in the 99.8th percentile for exploit probability.
What it is
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.
The record
Technical detail
- CVSS v3.1
- 8.8 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.89633 · 99.8th percentile
- Published
- 2024-05-31T00:00Z
EPSS history
Timeline