CVE-2024-39719: High severity Ollama Ollama vulnerability
An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39719?
CVE-2024-39719 is classified as a medium severity vulnerability due to its potential to disclose sensitive file existence information.
How do I fix CVE-2024-39719?
To mitigate CVE-2024-39719, ensure that your Ollama software is updated to a version beyond 0.3.14.
What does CVE-2024-39719 affect?
CVE-2024-39719 affects the Ollama software version 0.3.14 and earlier, specifically the api/create route.
What type of vulnerability is CVE-2024-39719?
CVE-2024-39719 is a file existence disclosure vulnerability that can reveal error messages to unauthorized users.
Can CVE-2024-39719 be exploited remotely?
Yes, CVE-2024-39719 can be exploited remotely by sending requests to the CreateModel route with non-existent paths.