Add CVSS 3.1 severity for GHSA-8hqg-whrw-pv92

[sunnypatell]

Changes

Added CVSS 3.1 scoring to GHSA-8hqg-whrw-pv92 (Ollama path traversal via unvalidated digest format).

• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High)

CVSS justification

• AV:N - exploitable over the network via the Ollama API
• AC:L - no special conditions needed; crafted digest triggers path traversal directly
• PR:L - requires access to interact with the Ollama API (pull model endpoint)
• C:H/I:H/A:H - path traversal allows arbitrary file read/write on the host, which can lead to full system compromise

References

• NVD: CVE-2024-37032
• Fix commit
• Fix PR

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[yhidad31]

Hello @sunnypatell. The GitHub Advisory Database Team includes both CVSS 4.0 and 3.1 scores in advisories only when both values have been provided by the CVE-assigning CNA. We do not combine NVD scores with CNA scores. Therefore, we will close this pull request and will not accept the contribution.