Lucene search

Veracode Vulnerability DatabaseVERACODE:46289

HistoryApr 09, 2024 - 5:40 a.m.

DNS Rebinding

2024-04-0905:40:19

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

dns rebinding

vulnerability

github

ollama

api

remote access

unauthorized user

denial of service

software

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

github.com/ollama/ollama is vulnerable to DNS rebinding. The vulnerability is due to ollama inadvertently allowing remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service.

CPENameOperatorVersion
github.com/ollama/ollamalev0.1.28
github.com/ollama/ollamalev0.1.28

CPE	Name	Operator	Version
	github.com/ollama/ollama	le	v0.1.28
	github.com/ollama/ollama	le	v0.1.28

References

github.com/advisories/GHSA-5jx5-hqx5-2vrj

github.com/ollama/ollama/releases

research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/

www.nccgroup.trust/us/our-research/?research=Technical+advisories