Detections
Analytics

Ollama < 0.1.34 Multiples Vulnerabilities

high Web App Scanning Plugin ID 114579

Language:

Synopsis

Ollama < 0.1.34 Multiples Vulnerabilities

Description

According to the self-reported version in its response header, the version of Ollama hosted on the remote web server is < 0.1.34. It is, therefore, affected by a Multiples vulnerabilities :

- A Remote Code Execution through models pulling - An Improper Resource Shutdown or Release through the req.Path parameter which is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Ollama version 0.1.34 or later.

See Also

https://www.oligo.security/blog/more-models-more-probllms

https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032

Plugin Details

Severity: High

ID: 114579

Type: remote

Published: 1/28/2025

Updated: 1/28/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2024-37032

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2024-37032

Vulnerability Information

CPE: cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/7/2024

Vulnerability Publication Date: 10/29/2024

Reference Information

CVE: CVE-2024-37032, CVE-2024-39721