CVE-2024-7773 - Vulnerability Details

** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45436. Notes: All CVE users should reference CVE-2024-45436 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

References

Link	Providers
https://github.com/ollama/ollama/commit/123a722a6f541e300bc8e34297ac378ebe23f527
https://huntr.com/bounties/aeb82e05-484f-4431-9ede-25a3478d8dbb
https://nvd.nist.gov/vuln/detail/CVE-2024-7773
https://www.cve.org/CVERecord?id=CVE-2024-7773

History

Tue, 15 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Title	Remote Code Execution via ZipSlip in ollama/ollama	ollama: Remote Code Execution via ZipSlip in ollama/ollama
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 15 Apr 2025 16:45:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:ollama:ollama:0.1.37:::::::*
Vendors & Products	Ollama Ollama ollama
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 15 Apr 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability in ollama/ollama version 0.1.37 allows for remote code execution (RCE) due to improper input validation in the handling of zip files. The vulnerability, known as ZipSlip, occurs in the parseFromZipFile function in server/model.go. The code does not check for directory traversal sequences (../) in file names within the zip archive, allowing an attacker to write arbitrary files to the file system. This can be exploited to create files such as /etc/ld.so.preload and a malicious shared library, leading to RCE.	REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45436. Notes: All CVE users should reference CVE-2024-45436 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.

Wed, 26 Mar 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ollama Ollama ollama
CPEs		cpe:2.3:a:ollama:ollama:0.1.37:::::::*
Vendors & Products		Ollama Ollama ollama
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 21 Mar 2025 14:30:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2024-7773 https://www.cve.org/CVERecord?id=CVE-2024-7773
Metrics	threat_severity `None`	threat_severity `Critical`

Thu, 20 Mar 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 20 Mar 2025 10:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in ollama/ollama version 0.1.37 allows for remote code execution (RCE) due to improper input validation in the handling of zip files. The vulnerability, known as ZipSlip, occurs in the parseFromZipFile function in server/model.go. The code does not check for directory traversal sequences (../) in file names within the zip archive, allowing an attacker to write arbitrary files to the file system. This can be exploited to create files such as /etc/ld.so.preload and a malicious shared library, leading to RCE.
Title		Remote Code Execution via ZipSlip in ollama/ollama
Weaknesses		CWE-20
References		https://github.com/ollama/ollama/commit/123a722a6f541e300bc8e34297ac378ebe23f527 https://huntr.com/bounties/aeb82e05-484f-4431-9ede-25a3478d8dbb
Metrics		cvssV3_0 `{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}`

MITRE

Status: REJECTED

Assigner: @huntr_ai

Published: 2025-03-20T10:09:13.433Z

Updated: 2025-04-15T15:49:34.681Z

Reserved: 2024-08-13T20:28:18.382Z

Link: CVE-2024-7773

Vulnrichment

Updated:

NVD

Status : Rejected

Published: 2025-03-20T10:15:37.393

Modified: 2025-04-15T16:15:24.090

Link: CVE-2024-7773

Redhat

Severity : Critical

Publid Date: 2025-03-20T10:09:13Z

Links: CVE-2024-7773 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-7773", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "REJECTED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-08-13T20:28:18.382Z", "datePublished": "2025-03-20T10:09:13.433Z", "dateUpdated": "2025-04-15T15:49:34.681Z", "dateRejected": "2025-04-15T15:49:34.681Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2025-04-15T15:49:34.681Z"}, "rejectedReasons": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45436. Notes: All CVE users should reference CVE-2024-45436 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage."}], "value": "** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45436. Notes: All CVE users should reference CVE-2024-45436 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"bugzilla": {"description": "ollama: Remote Code Execution via ZipSlip in ollama/ollama", "id": "2353591", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2353591"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["A flaw was found in Ollama, specifically in the parseFromZipFile function in server/model.go. This vulnerability allows remote code execution (RCE) via improper input validation when handling zip files, enabling directory traversal attacks (../) that allow an attacker to write arbitrary files to the file system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-7773", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-24/platform-resource-runner-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2025-03-20T10:09:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-7773\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-7773\nhttps://github.com/ollama/ollama/commit/123a722a6f541e300bc8e34297ac378ebe23f527\nhttps://huntr.com/bounties/aeb82e05-484f-4431-9ede-25a3478d8dbb"], "statement": "No Red Hat products are affected by this vulnerability.\nThis vulnerability is marked as critical rather than important because it enables unauthenticated remote code execution (RCE) with potential privilege escalation. The ZipSlip flaw allows an attacker to write arbitrary files, including modifying /etc/ld.so.preload, which forces the system to load a malicious shared library. This effectively hijacks all dynamically linked binaries, leading to persistent system compromise. Furthermore, the ability to establish a reverse shell provides the attacker full remote control, making exploitation trivial and highly impactful, especially in scenarios where the application processes untrusted ZIP archives.", "threat_severity": "Critical"}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object