CVE-2024-28224

HIGH8.8EPSS 0.19%

Ollama DNS rebinding vulnerability

發布日:2024/4/8修改日:2026/2/4

也稱為:GHSA-5jx5-hqx5-2vrjCGA-vxf6-qv66-6495GO-2024-2699

描述

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

受影響套件(2)

Go/github.com/jmorganca/ollamafrom 0, < 0.1.29
Go/github.com/ollama/ollamafrom 0, < 0.1.29

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://github.com/advisories/GHSA-5jx5-hqx5-2vrj
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-28224
PATCHhttps://github.com/ollama/ollama
WEBhttps://github.com/ollama/ollama/releases
WEBhttps://pkg.go.dev/vuln/GO-2024-2699
WEBhttps://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224
WEBhttps://www.nccgroup.trust/us/our-research/?research=Technical+advisories