8000 x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-39720 · Issue #3245 · golang/vulndb · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-39720 #3245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
GoVulnBot opened this issue Oct 31, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-39720 #3245

GoVulnBot opened this issue Oct 31, 2024 · 2 comments
Assignees
@tatianab
Labels
high priority triaged

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-39720 references a vulnerability in the following Go modules:

Module
github.com/ollama/ollama

Description:
An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/ollama/ollama
      vulnerable_at: 0.3.14
summary: CVE-2024-39720 in github.com/ollama/ollama
cves:
    - CVE-2024-39720
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39720
    - web: https://github.com/ollama/ollama/compare/v0.1.45...v0.1.46#diff-782c2737eecfa83b7cb46a77c8bdaf40023e7067baccd4f806ac5517b4563131L417
    - web: https://oligosecurity.webflow.io/blog/more-models-more-probllms
source:
    id: CVE-2024-39720
    created: 2024-10-31T21:01:24.9265414Z
review_status: UNREVIEWED
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/624515 mentions this issue: data/reports: add GO-2024-3245

@zpavlinovic zpavlinovic self-assigned this Nov 1, 2024
@tatianab tatianab assigned tatianab and unassigned zpavlinovic Dec 11, 2024
@tatianab tatianab reopened this Dec 11, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/635418 mentions this issue: data/reports: review GO-2024-3245

This was referenced Mar 21, 2025
Closed
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Mar 28, 2025
Open
This was referenced May 15, 2025
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
high priority triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3144
4 participants
@zpavlinovic @tatianab @gopherbot @GoVulnBot
0