CVE-2024-37032: Path Traversal
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.
Other sources
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/ollama/ollamato a version that resolves this vulnerability.Fixed in 0.1.34
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37032?
CVE-2024-37032 has a moderate severity due to improper validation leading to potential security risks.
How do I fix CVE-2024-37032?
To fix CVE-2024-37032, upgrade to Ollama version 0.1.34 or later, which includes the necessary validation improvements.
What types of input does CVE-2024-37032 fail to validate?
CVE-2024-37032 fails to validate digests that have fewer than 64 hex digits, more than 64 hex digits, or contain an initial ../ substring.
What software versions are affected by CVE-2024-37032?
Versions of Ollama prior to 0.1.34 are affected by CVE-2024-37032.
Is there any risk associated with exploiting CVE-2024-37032?
Exploiting CVE-2024-37032 could allow attackers to manipulate model paths and potentially access unintended resources.