CVE-2024-7773

Summary

CVE-2024-7773 is a newly disclosed vulnerability in ollama/ollama version 0.1.37 that enables remote code execution (RCE). The issue arises due to insufficient input validation in the parseFromZipFile function located in server/model.go. This function fails to prevent directory traversal sequences (../) in file names present within zip archives. An attacker can exploit this vulnerability, known as ZipSlip, to write arbitrary files to the file system. For instance, they could create files like /etc/ld.so.preload and a malicious shared library, leading to RCE.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.