Описание
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence.
A flaw was found in Ollama's model quantization engine. An unauthenticated remote attacker can exploit this vulnerability to read and exfiltrate the server's heap memory. This could lead to sensitive data exposure, further compromise of the system, and allow for stealthy persistence within the environment.
Отчет
An Important information disclosure flaw in Ollama's model quantization engine allows unauthenticated remote attackers to exfiltrate server heap memory, potentially leading to sensitive data exposure. This vulnerability is rated Important due to the potential for remote exploitation without authentication.
Меры по смягчению последствий
To mitigate this vulnerability, restrict network access to the Ollama service. Configure firewall rules to limit access to trusted networks or localhost only. If the Ollama service is running, a restart may be required for the changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Migration Toolkit for Applications 8 | mta/mta-solution-server-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Not affected | ||
| Red Hat build of Debezium 3 | debezium-ai-embeddings-ollama | Not affected | ||
| Red Hat build of Debezium 3 | langchain4j-ollama | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 | Not affected | ||
| Red Hat Trusted Profile Analyzer | rhtpa/rhtpa-trustification-service-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence.
Unauthenticated remote information disclosure vulnerability in Ollama' ...
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence.
EPSS
7.5 High
CVSS3