Vulnerability · Published Jan 28, 2025 · Assigned by Go
CVE-2024-45339Vulnerability when creating log files in github.com/golang/glog
High 7.1
In plain English
A high-severity security flaw in github.com/golang/glog from github.com/golang/glog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-glog | no fix listed | DEBIAN-CVE-2024-45339 |
| Debian:13 | golang-glog | 1.2.4-1 | DEBIAN-CVE-2024-45339 |
| Debian:14 | golang-glog | 1.2.4-1 | DEBIAN-CVE-2024-45339 |
| Go | github.com/golang/glog | 1.2.4 | GO-2025-3372 |
| Go | github.com/golang/glog | 1.2.4 | GHSA-6wxm-mpqj-6jpf |
| Ubuntu:22.04:LTS | golang-glog | no fix listed | UBUNTU-CVE-2024-45339 |
| Ubuntu:24.04:LTS | golang-glog | no fix listed | UBUNTU-CVE-2024-45339 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| github.com/golang/glog | github.com/golang/glog | 0 – before 1.2.4 |
References
- https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
- https://github.com/golang/glog/pull/74
- https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
- https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
- https://pkg.go.dev/vuln/GO-2025-3372
- https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html