github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #14023] fix(upload): security: replace MD5 with SHA-256 for upload ETag computation #40348

New Issue
Open
opened 2026-04-23 01:15:57 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 01:15:57 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/14023
Author: @ravisastryk
Created: 2/2/2026
Status: 🔄 Open

Base: main ← Head: fix/replace-md5-etag-upload

📝 Commits (1)

  • c98b701 security: replace MD5 with SHA-256 for upload ETag computation

📊 Changes

2 files changed (+44 additions, -8 deletions)

View changed files

➕ .github/workflows/cryptoguard.yaml (+37 -0)
📝 server/upload.go (+7 -8)

📄 Description

fix(upload): replace MD5 with SHA-256 for multipart ETag computation

Replace crypto/md5 with crypto/sha256 in server/upload.go for computing composite ETags during multipart blob uploads. MD5 is cryptographically broken (CWE-328) and disallowed under Go's FIPS 140-only mode.

Security Vulnerability

  • MD5 has known collision vulnerabilities where an attacker could craft payloads with identical hashes, undermining model integrity verification during push
  • Go's own crypto/md5 docs state: "MD5 is cryptographically broken and should not be used for secure applications" Refer here
  • Causes runtime panics in FIPS 140-only environments (Go 1.24+)

Note:
ETag format remains hex(hash)-N; only the hash strength changes. Ollama's own registry should accept the stronger hash transparently. No user-facing behavior change.

Discovered by

Thanks to the open source CryptoGuard-Go, an automated cryptographic misuse detection for Go (Rule: CRYPTO001, CWE-328, Severity: HIGH).

Validation

go install github.com/ravisastryk/cryptoguard-go/cmd/cryptoguard@latest
cryptoguard -severity high ./server/upload.go
# Expected: 0 issues

This change prevents future cryptographic vulnerabilities

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/14023 **Author:** [@ravisastryk](https://github.com/ravisastryk) **Created:** 2/2/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/replace-md5-etag-upload` --- ### 📝 Commits (1) - [`c98b701`](https://github.com/ollama/ollama/commit/c98b701a5dfbb40f8a716ae414612a5f140b0dca) security: replace MD5 with SHA-256 for upload ETag computation ### 📊 Changes **2 files changed** (+44 additions, -8 deletions) <details> <summary>View changed files</summary> ➕ `.github/workflows/cryptoguard.yaml` (+37 -0) 📝 `server/upload.go` (+7 -8) </details> ### 📄 Description ## fix(upload): replace MD5 with SHA-256 for multipart ETag computation Replace `crypto/md5` with `crypto/sha256` in `server/upload.go` for computing composite ETags during multipart blob uploads. MD5 is cryptographically broken (CWE-328) and disallowed under Go's FIPS 140-only mode. ## Security Vulnerability - MD5 has known collision vulnerabilities where an attacker could craft payloads with identical hashes, undermining model integrity verification during push - Go's own `crypto/md5` docs state: *"MD5 is cryptographically broken and should not be used for secure applications"* Refer [here](https://pkg.go.dev/crypto/md5) - Causes runtime panics in FIPS 140-only environments (Go 1.24+) **Note:** ETag format remains `hex(hash)-N`; only the hash strength changes. Ollama's own registry should accept the stronger hash transparently. No user-facing behavior change. ## Discovered by Thanks to the open source [CryptoGuard-Go](https://github.com/ravisastryk/cryptoguard-go), an automated cryptographic misuse detection for Go (Rule: CRYPTO001, CWE-328, Severity: HIGH). ## Validation ``` go install github.com/ravisastryk/cryptoguard-go/cmd/cryptoguard@latest cryptoguard -severity high ./server/upload.go # Expected: 0 issues ``` This change prevents future cryptographic vulnerabilities --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 01:15:57 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#40348
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?