← fix library

CRITICAL Ollama: Ollama CVE-2024-37032 (Probllama) — remote code execution

Why it matters

Your Ollama version is older than 0.1.34 and vulnerable to Probllama: without any login, an attacker can write arbitrary files to your server and execute code on it. Ollama has no built-in authentication, so an exposed vulnerable instance is fully open.

Fix it — 2 steps

1. Upgrade Ollama to 0.1.34 or later: `curl -fsSL https://ollama.com/install.sh | sh` (or update the docker image).
2. Bind Ollama to localhost (OLLAMA_HOST=127.0.0.1) or put an authenticating reverse proxy in front — see the 'Ollama API open to the internet' card.

Verify it’s fixed

curl -m 5 http://127.0.0.1:11434/api/version  # version must be >= 0.1.34

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-37032
• https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032