Bug 1222510 (CVE-2024-28224)

Summary:	VUL-0: CVE-2024-28224: ollama: DNS rebinding vulnerability
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Loren Burkholder <computersemiexpert>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	thomas.leroy
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/400768/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-09 07:43:43 UTC

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

References:
https://www.nccgroup.trust/us/our-research/?research=Technical+advisories
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28224
https://www.cve.org/CVERecord?id=CVE-2024-28224
https://github.com/ollama/ollama/releases
https://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/

Comment 1 Thomas Leroy 2024-04-09 07:44:26 UTC

openSUSE:Factory/ollama is affected.

Comment 2 Loren Burkholder 2024-04-17 12:12:07 UTC

Factory has been upgraded to 0.1.31