Lucene search

GitHub Advisory DatabaseGHSA-5JX5-HQX5-2VRJ

HistoryApr 08, 2024 - 9:31 p.m.

Ollama DNS rebinding vulnerability

2024-04-0821:31:16

CWE-290

CWE-350

GitHub Advisory Database

github.com

ollama

dns rebinding

vulnerability

unauthorized access

api

chat

model deletion

denial of service

software

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

Affected configurations

Vulners

Node

github.com\/ollama\/ollamaRange<0.1.29

CPENameOperatorVersion
github.com/ollama/ollamalt0.1.29

CPE	Name	Operator	Version
	github.com/ollama/ollama	lt	0.1.29

References

github.com/advisories/GHSA-5jx5-hqx5-2vrj

github.com/ollama/ollama/releases

nvd.nist.gov/vuln/detail/CVE-2024-28224

pkg.go.dev/vuln/GO-2024-2699

research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224

www.nccgroup.trust/us/our-research/?research=Technical+advisories