mirror of
https://github.com/danielmiessler/Fabric.git
synced 2026-02-11 14:35:09 -05:00
d3de731967
• Update ollama package to version 0.11.7 • Refresh go.sum with new dependency checksums - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-0317](https://nvd.nist.gov/vuln/detail/CVE-2025-0317) - **CVSS Score**: 7.5 (High) - **Description**: A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding function, causing the server to crash and resulting in a Denial of Service (DoS) attack. - **Affected**: Ollama server versions ≤ 0.3.14 - **Impact**: Denial of Service through division by zero error - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-0315](https://nvd.nist.gov/vuln/detail/CVE-2025-0315) - **CVSS Score**: 7.5 (High) - **Description**: Vulnerability allows Denial of Service via customized GGUF model file upload on Ollama server. - **Affected**: Ollama/ollama versions ≤ 0.3.14 - **Impact**: Denial of Service through malicious GGUF model file uploads - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-12886](https://nvd.nist.gov/vuln/detail/CVE-2024-12886) - **CVSS Score**: 7.5 (High) - **Description**: An Out-Of-Memory (OOM) vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. - **Affected**: Ollama server version 0.3.14 - **Impact**: Denial of Service through memory exhaustion via gzip bomb attack - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-8063](https://nvd.nist.gov/vuln/detail/CVE-2024-8063) - **CVSS Score**: 7.5 (High) - **Description**: Security vulnerability with high severity rating - **Impact**: Requires patching for security compliance - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-12055](https://nvd.nist.gov/vuln/detail/CVE-2024-12055) - **CVSS Score**: 7.5 (High) - **Description**: High-severity security vulnerability requiring immediate attention - **Impact**: Critical security flaw needing remediation - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-51471](https://nvd.nist.gov/vuln/detail/CVE-2025-51471) - **CVSS Score**: 6.9 (Medium) - **Description**: Medium severity security vulnerability - **Impact**: Security risk requiring patching as part of comprehensive security updates - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2025-46394](https://nvd.nist.gov/vuln/detail/CVE-2025-46394) - **CVSS Score**: 3.2 (Low) - **Description**: Low-severity security issue - **Impact**: Minor security concern addressed as part of comprehensive security maintenance - **Link**: [https://nvd.nist.gov/vuln/detail/CVE-2024-58251](https://nvd.nist.gov/vuln/detail/CVE-2024-58251) - **CVSS Score**: 2.5 (Low) - **Description**: Low-severity security vulnerability - **Impact**: Minimal security risk addressed for comprehensive security posture This comprehensive security fix addresses **8 CVEs** total: - **5 High Severity** vulnerabilities (CVSS 7.5) - **1 Medium Severity** vulnerability (CVSS 6.9) - **2 Low Severity** vulnerabilities (CVSS 3.2 and 2.5) The majority of high-severity issues are related to **Ollama server vulnerabilities** that could lead to Denial of Service attacks through various vectors including division by zero errors, memory exhaustion, and malicious file uploads. These fixes ensure robust protection against these attack vectors and maintain system availability. **Priority**: The high-severity Ollama vulnerabilities should be considered critical for any systems running Ollama server components, as they can lead to service disruption and potential system crashes.
132 lines
5.9 KiB
Modula-2
132 lines
5.9 KiB
Modula-2
module github.com/danielmiessler/fabric
|
|
|
|
go 1.24.0
|
|
|
|
toolchain go1.24.2
|
|
|
|
require (
|
|
github.com/anthropics/anthropic-sdk-go v1.9.1
|
|
github.com/atotto/clipboard v0.1.4
|
|
github.com/aws/aws-sdk-go-v2 v1.36.4
|
|
github.com/aws/aws-sdk-go-v2/config v1.27.27
|
|
github.com/aws/aws-sdk-go-v2/service/bedrock v1.34.1
|
|
github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.30.0
|
|
github.com/gabriel-vasile/mimetype v1.4.9
|
|
github.com/gin-gonic/gin v1.10.1
|
|
github.com/go-git/go-git/v5 v5.16.2
|
|
github.com/go-shiori/go-readability v0.0.0-20250217085726-9f5bf5ca7612
|
|
github.com/google/go-github/v66 v66.0.0
|
|
github.com/hasura/go-graphql-client v0.14.4
|
|
github.com/jessevdk/go-flags v1.6.1
|
|
github.com/joho/godotenv v1.5.1
|
|
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
|
|
github.com/mattn/go-sqlite3 v1.14.28
|
|
github.com/ollama/ollama v0.11.7
|
|
github.com/openai/openai-go v1.8.2
|
|
github.com/otiai10/copy v1.14.1
|
|
github.com/pkg/errors v0.9.1
|
|
github.com/samber/lo v1.50.0
|
|
github.com/sgaunet/perplexity-go/v2 v2.8.0
|
|
github.com/spf13/cobra v1.9.1
|
|
github.com/stretchr/testify v1.10.0
|
|
golang.org/x/oauth2 v0.30.0
|
|
golang.org/x/text v0.27.0
|
|
google.golang.org/api v0.236.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/gorilla/websocket v1.5.3 // indirect
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go v0.121.2 // indirect
|
|
cloud.google.com/go/auth v0.16.2 // indirect
|
|
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
|
|
cloud.google.com/go/compute/metadata v0.7.0 // indirect
|
|
dario.cat/mergo v1.0.2 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/ProtonMail/go-crypto v1.3.0 // indirect
|
|
github.com/andybalholm/cascadia v1.3.3 // indirect
|
|
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
|
|
github.com/aws/smithy-go v1.22.2 // indirect
|
|
github.com/bytedance/sonic v1.13.3 // indirect
|
|
github.com/bytedance/sonic/loader v0.2.4 // indirect
|
|
github.com/cloudflare/circl v1.6.1 // indirect
|
|
github.com/cloudwego/base64x v0.1.5 // indirect
|
|
github.com/coder/websocket v1.8.13 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/emirpasic/gods v1.18.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
|
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
|
|
github.com/go-git/go-billy/v5 v5.6.2 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.26.0 // indirect
|
|
github.com/go-shiori/dom v0.0.0-20230515143342-73569d674e1c // indirect
|
|
github.com/goccy/go-json v0.10.5 // indirect
|
|
github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
|
|
github.com/google/go-querystring v1.1.0 // indirect
|
|
github.com/google/s2a-go v0.1.9 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.14.2 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kevinburke/ssh_config v1.2.0 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.10 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/otiai10/mint v1.6.3 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pjbgf/sha1cd v0.4.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/sergi/go-diff v1.4.0 // indirect
|
|
github.com/skeema/knownhosts v1.3.1 // indirect
|
|
github.com/spf13/pflag v1.0.6 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/tidwall/sjson v1.2.5 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.14 // indirect
|
|
github.com/xanzy/ssh-agent v0.3.3 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
|
|
go.opentelemetry.io/otel v1.36.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.36.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.36.0 // indirect
|
|
golang.org/x/arch v0.18.0 // indirect
|
|
golang.org/x/crypto v0.40.0 // indirect
|
|
golang.org/x/exp v0.0.0-20250531010427-b6e5de432a8b // indirect
|
|
golang.org/x/net v0.41.0 // indirect
|
|
golang.org/x/sync v0.16.0 // indirect
|
|
golang.org/x/sys v0.34.0 // indirect
|
|
google.golang.org/genai v1.17.0
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
|
|
google.golang.org/grpc v1.73.0 // indirect
|
|
google.golang.org/protobuf v1.36.6 // indirect
|
|
gopkg.in/warnings.v0 v0.1.2 // indirect
|
|
)
|