CVE-2024-28224
Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized use...
Summary
Ollama DNS rebinding vulnerability
Original description
The description as published by the source.
Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/ollama/ollama
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.29"}]}]
References
- advisory nvd.nist.gov
- advisory nccgroup.trust
- advisory github.com
- advisory research.nccgroup.com
- package github.com
- package github.com
- web pkg.go.dev
- web research.nccgroup.com