AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OllamaGHSA-846m-99qv-67mg

Ollama can extract members of a ZIP archive outside of the parent directory

Ollama

CVE-2024-45436 · Published Aug 29, 2024 · updated Aug 30, 2024

High7.5
Fix: upgrade to 0.1.47 or later
GitHub advisory

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

Affected versions

PackageAffectedFixed in
github.com/ollama/ollama
Go
< 0.1.470.1.47
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2024-45436, GO-2024-3104

More Ollama advisories

All Ollama
High 7.5Mar 20, 2025Ollama Divide by Zero VulnerabilityCVE-2024-8063no fix yetHigh 7.5Mar 20, 2025Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIPCVE-2024-12886no fix yetHigh 7.5Mar 20, 2025Ollama Allows Out-of-Bounds ReadCVE-2024-12055no fix yetHigh 8.2Oct 31, 2024Ollama Out-of-bounds ReadCVE-2024-39720fixed in 0.1.46MediumMay 31, 2024Ollama does not validate the format of the digest (sha256 with 64 hex digits)CVE-2024-37032fixed in 0.1.34High 8.8Apr 8, 2024Ollama DNS rebinding vulnerabilityCVE-2024-28224fixed in 0.1.29