VDB
GO-2024-2901
GO-2024-2901
PUBLISHED
Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | ollama/ollama | 0, 0 |
| chainguard | ollama | 0, 0, 0 |
| wolfi | ollama | 0, 0, 0 |
Timeline
- Jun 14, 2024 CVE Published
- Feb 4, 2026 CVE Updated
References
- https://github.com/advisories/GHSA-8hqg-whrw-pv92 advisory
- https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58 url
- https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032 url
- https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34 url
- https://github.com/ollama/ollama/pull/4175 fix
- https://github.com/ollama/ollama/commit/2a21363bb756a7341d3d577f098583865bd7603f fix