Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Ollama

CVE-2024-37032: Ollama does not validate the format of the digest (sha256 with 64 hex digits)

mediumGHSA-8hqg-whrw-pv92

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

Published May 31, 2024 · Updated Sep 6, 2024

Affected packages

github.com/ollama/ollama

Ecosystem
Go
Affected
< 0.1.34
Fixed in
0.1.34
Check
go list -m github.com/ollama/ollama

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

Credited to lukas-braune.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Ollama vulnerabilities

All Ollama entries