CVE-2024-45436: Path Traversal
extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.
Other sources
extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/ollama/ollamato a version that resolves this vulnerability.Fixed in 0.1.47
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45436?
The severity of CVE-2024-45436 is classified as medium due to its potential for unauthorized file extraction.
How do I fix CVE-2024-45436?
To fix CVE-2024-45436, upgrade Ollama to version 0.1.47 or later.
What versions are affected by CVE-2024-45436?
CVE-2024-45436 affects all versions of Ollama before 0.1.47.
What specific functionality is vulnerable in CVE-2024-45436?
The vulnerable functionality in CVE-2024-45436 is the `extractFromZipFile` method in model.go.
What are the potential impacts of CVE-2024-45436?
The potential impacts of CVE-2024-45436 include unauthorized access to files outside of the intended directory structure.