erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: June 24, 2024

1 editorial brief and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Probllama. Anyone running Ollama older than 0.1.34, and anyone whose Ollama API (port 11434) is reachable from outside the host, especially Docker deployments, which listen on 0.0.0.0 and run as root by default.
  • Maven: 2 critical advisories (org.xwiki.platform:xwiki-platform-rendering-macro-include, org.apache.streampipes:streampipes-resource-management). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-37032

Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)

The bug was fixed in May 2024, so anything current is patched; the lasting risk is Ollama servers left reachable from the internet with no authentication, which is still very common.

Must act: Anyone running Ollama older than 0.1.34, and anyone whose Ollama API (port 11434) is reachable from outside the host, especially Docker deployments, which listen on 0.0.0.0 and run as root by default.

Can relax: Users of a current Ollama build on a laptop or the default Linux install bound to 127.0.0.1 were never remotely reachable and are patched.

  1. Check your version with `ollama --version` (or the image tag) and upgrade to a current release
  2. Make sure the API listens only on 127.0.0.1 unless you deliberately need remote access; check OLLAMA_HOST and Docker -p mappings
  3. Put any remote Ollama behind a reverse proxy or gateway that enforces authentication

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>