CVE-2024-45339: Vulnerability when creating log files in github.com/golang/glog

Deferred

AliasesSUSE-SU-2025:02149-1SUSE-SU-2025:02150-1SUSE-SU-2025:0580-1+308 more

Published 28-01-2025Last modified 30-04-2026

Vulnerability summary

CVE-2024-45339 is a high (CVSS 7.1) vulnerability in github.com/golang/glog. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.32%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 48

OPENSUSE-SU-2025:14710-1 OPENSUSE-SU-2025:15764-1 OPENSUSE-SU-2026:11126-1 RHSA-2025:2223 SUSE-SU-2025:01985-1 SUSE-SU-2025:0297-1+42 more

Timeline

28-01-2025
PublishedVulnerability first disclosed.
30-04-2026
Last modifiedVulnerability information updated.

Description

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

CVSS metrics

8 scores · 7 sources · 2 versions

v4.07.2v3.17.1

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.32% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard150 products

amass< 4.2.0-r18
caddy< 2.9.1-r3
caddy-fips< 2.9.1-r3
caddy-man< 2.9.1-r3
caddy-src< 2.9.1-r3

cert-exporter< 2.14.0-r5
cert-exporter-fips< 2.14.0-r5
cluster-proportional-autoscaler< 1.9.0-r5
cluster-proportional-autoscaler-compat< 1.9.0-r5
cluster-proportional-autoscaler-fips< 1.9.0-r3
crossplane-provider-family-gcp< 1.11.2-r4
crossplane-provider-family-gcp-compat< 1.11.2-r4
crossplane-provider-gcp< 1.11.2-r4
crossplane-provider-gcp-cloudplatform< 1.11.2-r4
crossplane-provider-gcp-cloudplatform-compat< 1.11.2-r4
crossplane-provider-gcp-compute< 1.11.2-r4
crossplane-provider-gcp-compute-compat< 1.11.2-r4
crossplane-provider-gcp-container< 1.11.2-r4
crossplane-provider-gcp-container-compat< 1.11.2-r4
crossplane-provider-gcp-dns< 1.11.2-r4
crossplane-provider-gcp-dns-compat< 1.11.2-r4
crossplane-provider-gcp-kms< 1.11.2-r4
crossplane-provider-gcp-kms-compat< 1.11.2-r4
crossplane-provider-gcp-pubsub< 1.11.2-r4
crossplane-provider-gcp-pubsub-compat< 1.11.2-r4
crossplane-provider-gcp-storage< 1.11.2-r4
crossplane-provider-gcp-storage-compat< 1.11.2-r4
dgraph< 24.0.5-r5
flux-image-reflector-controller< 0.33.0-r8
flux-image-reflector-controller-fips< 0.33.0-r6
flux-image-reflector-controller-iamguarded-compat< 0.33.0-r8
flyte< 1.14.1-r3
google-osconfig-agent< 20250122.00-r2
grafana-mimir< 2.15.0-r4
kube-bench-fips< 0.10.0-r0
kubeflow< 1.10.0-r3
kubeflow-access-management< 1.10.0-r3
kubeflow-access-management-compat< 1.10.0-r3
kubeflow-access-management-fips< 1.10.0-r2
kubeflow-access-management-fips-compat< 1.10.0-r2
kubeflow-admission-webhook< 1.10.0-r3
kubeflow-admission-webhook-compat< 1.10.0-r3
kubeflow-admission-webhook-fips< 1.10.0-r2
kubeflow-admission-webhook-fips-compat< 1.10.0-r2
kubeflow-fips< 1.10.0-r2
kubeflow-notebook-controller< 1.10.0-r3
kubeflow-notebook-controller-compat< 1.10.0-r3
kubeflow-notebook-controller-fips< 1.10.0-r2
kubeflow-notebook-controller-fips-compat< 1.10.0-r2
kubeflow-pipelines< 2.4.0-r2
kubeflow-pipelines-apiserver< 2.4.0-r2
kubeflow-pipelines-cache_server< 2.4.0-r2
kubeflow-pipelines-cache-deployer< 2.4.0-r2
kubeflow-pipelines-cache-deployer-compat< 2.4.0-r2
kubeflow-pipelines-frontend< 2.4.0-r2
kubeflow-pipelines-metadata-envoy-config< 2.4.0-r2
kubeflow-pipelines-metadata-writer< 2.4.0-r2
kubeflow-pipelines-metadata-writer-compat< 2.4.0-r2
kubeflow-pipelines-persistence_agent< 2.4.0-r2
kubeflow-pipelines-scheduledworkflow< 2.4.0-r2
kubeflow-pipelines-viewer-crd-controller< 2.4.0-r2
kubeflow-profile-controller< 1.10.0-r3
kubeflow-profile-controller-compat< 1.10.0-r3
kubeflow-profile-controller-fips< 1.10.0-r2
kubeflow-profile-controller-fips-compat< 1.10.0-r2
kubeflow-pvcviewer-controller< 1.10.0-r3
kubeflow-pvcviewer-controller-compat< 1.10.0-r3
kubeflow-pvcviewer-controller-fips< 1.10.0-r2
kubeflow-pvcviewer-controller-fips-compat< 1.10.0-r2
kubeflow-tensorboard-controller< 1.10.0-r3
kubeflow-tensorboard-controller-compat< 1.10.0-r3
kubeflow-tensorboard-controller-fips< 1.10.0-r2
kubeflow-tensorboard-controller-fips-compat< 1.10.0-r2
kyverno-1.13< 1.13.2-r7
kyverno-background-controller-1.13< 1.13.2-r7
kyverno-background-controller-fips-1.13< 1.13.2-r5
kyverno-cleanup-controller-1.13< 1.13.2-r7
kyverno-cleanup-controller-fips-1.13< 1.13.2-r5
kyverno-cli-1.13< 1.13.2-r7
kyverno-cli-fips-1.13< 1.13.2-r5
kyverno-fips-1.13< 1.13.2-r5
kyverno-init-container-1.13< 1.13.2-r7
kyverno-init-container-fips-1.13< 1.13.2-r5
kyverno-notation-aws< 1.1-r3
kyverno-notation-aws-compat< 1.1-r3
kyverno-notation-aws-fips< 1.1-r3
kyverno-reports-controller-1.13< 1.13.2-r7
kyverno-reports-controller-fips-1.13< 1.13.2-r5
nfs-subdir-external-provisioner< 4.0.18-r15
nfs-subdir-external-provisioner-fips< 4.0.18-r17
opa< 1.1.0-r0
opa-envoy< 1.0.0-r0
opa-fips< 1.1.0-r0
opa-fips-envoy< 1.0.0-r0
portieris< 0.13.23-r3
portieris-compat< 0.13.23-r3
portieris-fips< 0.13.23-r3
pulumi< 3.147.0-r2
pulumi-kubernetes-operator< 1.16.0-r9
pulumi-language-dotnet< 3.71.1-r5
pulumi-language-go< 3.147.0-r2
pulumi-language-java< 1.0.0-r3
pulumi-language-nodejs< 3.147.0-r2
pulumi-language-python< 3.147.0-r2
pulumi-language-yaml< 1.13.0-r6
sigstore-scaffolding< 0.7.18-r3
sigstore-scaffolding-cloudsqlproxy< 0.7.18-r3
sigstore-scaffolding-ctlog-createctconfig< 0.7.18-r3
sigstore-scaffolding-ctlog-managectroots< 0.7.18-r3
sigstore-scaffolding-ctlog-verifyfulcio< 0.7.18-r3
sigstore-scaffolding-fips< 0.7.18-r3
sigstore-scaffolding-fips-cloudsqlproxy< 0.7.18-r3
sigstore-scaffolding-fips-ctlog-createctconfig< 0.7.18-r3
sigstore-scaffolding-fips-ctlog-managectroots< 0.7.18-r3
sigstore-scaffolding-fips-ctlog-verifyfulcio< 0.7.18-r3
sigstore-scaffolding-fips-fulcio-createcerts< 0.7.18-r3
sigstore-scaffolding-fips-getoidctoken< 0.7.18-r3
sigstore-scaffolding-fips-rekor-createsecret< 0.7.18-r3
sigstore-scaffolding-fips-trillian-createdb< 0.7.18-r3
sigstore-scaffolding-fips-trillian-createtree< 0.7.18-r3
sigstore-scaffolding-fips-trillian-updatetree< 0.7.18-r3
sigstore-scaffolding-fips-tsa-createcertchain< 0.7.18-r3
sigstore-scaffolding-fips-tuf-createsecret< 0.7.18-r3
sigstore-scaffolding-fips-tuf-server< 0.7.18-r3
sigstore-scaffolding-fulcio-createcerts< 0.7.18-r3
sigstore-scaffolding-getoidctoken< 0.7.18-r3
sigstore-scaffolding-rekor-createsecret< 0.7.18-r3
sigstore-scaffolding-trillian-createdb< 0.7.18-r3
sigstore-scaffolding-trillian-createtree< 0.7.18-r3
sigstore-scaffolding-trillian-updatetree< 0.7.18-r3
sigstore-scaffolding-tsa-createcertchain< 0.7.18-r3
sigstore-scaffolding-tuf-createsecret< 0.7.18-r3
sigstore-scaffolding-tuf-server< 0.7.18-r3
skaffold< 2.14.0-r0
smarter-device-manager< 1.20.11-r13
smarter-device-manager-fips< 1.20.11-r21
spark-operator< 2.1.0-r4
spark-operator-fips< 2.1.0-r2
spark-operator-oci-entrypoint< 2.1.0-r4
sriov-network-device-plugin< 3.9.0-r1
sriov-network-device-plugin-fips< 3.9.0-r2
step< 0.28.2-r6
step-ca< 0.28.1-r5
step-ca-fips< 0.28.1-r4
step-fips< 0.28.2-r4
step-issuer< 0.9.7-r1
step-issuer-compat< 0.9.7-r1
step-issuer-fips< 0.9.7-r2
step-issuer-fips-compat< 0.9.7-r2
terraform-provider-google< 6.18.1-r0

Show all 150

Wolfi50 products

amass< 4.2.0-r18
caddy< 2.9.1-r3
caddy-man< 2.9.1-r3
caddy-src< 2.9.1-r3
cert-exporter< 2.14.0-r5

Show all 50

2 vendors · 200 products · Showing 200 of 240

References

26 links

github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2REPORTWEBFIX
github.com/golang/glog/pull/74REPORTFIXWEB
groups.google.com/g/golang-announce/c/H-Q4ouHWyKsREPORTWEB
owasp.org/www-community/vulnerabilities/Insecure_Temporary_FileREPORTWEB
pkg.go.dev/vuln/GO-2025-3372REPORTWEB
lists.debian.org/debian-lts-announce/2025/02/msg00019.htmlWEB
www.suse.com/support/update/announcement/2025/suse-su-202502149-1/Advisory
bugzilla.suse.com/1239948REPORT
bugzilla.suse.com/1244304REPORT
bugzilla.suse.com/1244503REPORT

Show all 26 references

www.suse.com/security/cve/CVE-2024-45339WEB
www.suse.com/support/update/announcement/2025/suse-su-202502150-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-20250580-1/Advisory
bugzilla.suse.com/1236560REPORT
www.suse.com/support/update/announcement/2025/suse-su-20250611-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202520746-1/Advisory
bugzilla.suse.com/1212418REPORT
bugzilla.suse.com/1212759REPORT
ubuntu.com/security/CVE-2024-45339REPORT
www.cve.org/CVERecord?id=CVE-2024-45339REPORT
security-tracker.debian.org/tracker/CVE-2024-45339Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45339.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-45339AdvisoryOval
github.com/golang/glogPACKAGE
lists.opensuse.org/archives/…Advisory