VDB
GHSA-8hqg-whrw-pv92
GHSA-8hqg-whrw-pv92
PUBLISHED
Ollama does not validate the format of the digest (sha256 with 64 hex digits)
Record from GitHub Advisory Database · Published May 31, 2024
github.com/ollama/ollama is fixed in 0.1.34 (Go Modules)
Ollama does not validate the format of the digest (sha256 with 64 hex digits)
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/ollama/ollama | Go Modules | 0.1.34 |
| ollama | Wolfi | 0.1.44-r0 |
| ollama | Chainguard | 0.1.44-r0 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| github.com | ollama/ollama | 0 |
| wolfi | ollama | 0 |
| chainguard | ollama | 0 |
Timeline
- May 31, 2024 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-8hqg-whrw-pv92
vulnetix vdb fixes GHSA-8hqg-whrw-pv92Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-8hqg-whrw-pv92/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/ollama/ollama/commit/2a21363bb756a7341d3d577f098583865bd7603f url
- https://pkg.go.dev/vuln/GO-2024-2901 url
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032 url
- https://github.com/ollama/ollama/pull/4175 url
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58 url
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-37032 advisory
- https://github.com/advisories/GHSA-8hqg-whrw-pv92 advisory
- https://github.com/ollama/ollama package