Описание
An Out-Of-Memory (OOM) vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. The vulnerability is present in the makeRequestWithRetry and getAuthorizationToken functions, which use io.ReadAll to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.
A flaw was found in Ollama. This vulnerability allows a denial of service (DoS) condition via excessive memory consumption when a malicious API server responds with a gzip bomb HTTP response. The makeRequestWithRetry and getAuthorizationToken functions use io.ReadAll to read the response body, which leads to out-of-memory crashes.
Отчет
Ansible LightSpeed does not use Ollama server. The library is included in the image just for local development or testing.
Меры по смягчению последствий
Implementing input validation to restrict the types of GZIP data accepted by the application would help to mitigate the risk of exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/platform-resource-runner-rhel8 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.
An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server ver ...
Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP
EPSS
7.5 High
CVSS3