The version of Ollama installed on the remote host is prior to 0.1.46. It is, therefore, affected by multiple vulnerabilities:

  - An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF     file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that     includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application     through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).
    (CVE-2024-39720)

  - An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is     deployed via path traversal in the api/push route. (CVE-2024-39722)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ollama < 0.1.46 Multiple Vulnerabilities

high Nessus Plugin ID 210502

Version 1.1