CVE-2024-7773

Description

A flaw was found in Ollama, specifically in the parseFromZipFile function in server/model.go. This vulnerability allows remote code execution (RCE) via improper input validation when handling zip files, enabling directory traversal attacks (../) that allow an attacker to write arbitrary files to the file system.

Statement

This CVE has been marked as Rejected by the assigning CNA. The Rejected CVE Record is a duplicate of CVE-2024-45436.

No Red Hat products are affected by this vulnerability.

Understanding the Weakness (CWE)

CWE-20

Availability

Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

An attacker could provide unexpected values and cause a program crash or arbitrary control of resource allocation, leading to excessive consumption of resources such as memory and CPU.

Confidentiality

Technical Impact: Read Memory; Read Files or Directories

An attacker could read confidential data if they are able to control resource references.

Integrity,Confidentiality,Availability

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

An attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.