CVE-2024-45436
Ollama
CVE-2024-45436 in Ollama allows for directory traversal due to improper handling of ZIP archive extraction. Specifically, the extractFromZipFile function in model.go before version 0.1.47 can extract files to locations outside of the intended parent directory. While the CVSS score is 7.5, the SOCRadar Vulnerability Risk Score (SVRS) of 71 indicates a significant risk.
This vulnerability can be exploited to overwrite sensitive system files or introduce malicious code, potentially leading to remote code execution or other unauthorized access. Given that active exploits are already published, it is critical to update Ollama to version 0.1.47 or later immediately. Failure to address CVE-2024-45436 could expose systems to significant compromise. This highlights the importance of addressing even moderately scored vulnerabilities quickly when exploit code becomes readily available. This ZIP archive issue can lead to severe security breaches.
Description
CVE-2024-45436 is a vulnerability in Ollama, a Go library for working with ZIP archives. The vulnerability allows an attacker to extract members of a ZIP archive outside of the parent directory. This could allow an attacker to gain access to sensitive files or execute arbitrary code on the victim's system.
Key Insights
- The SVRS for CVE-2024-45436 is 38, which indicates that the vulnerability is of moderate severity.
- The vulnerability is caused by a flaw in the extractFromZipFile function in Ollama.
- The vulnerability can be exploited by an attacker to extract files outside of the parent directory.
- The vulnerability is not currently being exploited in the wild.
Mitigation Strategies
- Update to Ollama version 0.1.47 or later.
- Restrict access to ZIP archives from untrusted sources.
- Use a security scanner to identify and patch vulnerable systems.
Additional Information
- The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning about this vulnerability.
- There are no known threat actors or APT groups that are actively exploiting this vulnerability.
- If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.