CVE-2024-37032

Ollama versions before 0.1.34 are vulnerable to a path traversal vulnerability (CWE-22 ) within the model pull mechanism. The root cause is a failure to validate the format of the digest field in OCI manifests, allowing attackers to inject path traversal sequences (e.g., ../) during the GetBlobsP...