CVE-2024-45339
Aliases:GHSA-6wxm-mpqj-6jpfGO-2025-3372DEBIAN-CVE-2024-45339CGA-236j-4jmf-6q85CGA-2476-pgp6-24pvCGA-2594-66gg-9cxpCGA-26h9-wcx3-w9vcCGA-287f-7w52-9mh4CGA-28pr-j8wp-qm3pCGA-294m-pcgf-wgg9CGA-2jxf-fmvr-rfv3CGA-2pc5-cq92-h78cCGA-2pgh-3jw9-5656CGA-2v5g-qvhc-w7vjCGA-2wg9-qh93-q5j9CGA-2wvx-58xq-vg44CGA-2xwh-hm44-hr36CGA-34wh-6jf6-4gpvCGA-358c-3875-v65pCGA-35mx-mjq5-hcmrCGA-365q-4qmx-hhfrCGA-3pfh-7r5c-mm69CGA-3pfw-cmjc-84jvCGA-3rc2-v36x-gf53CGA-3xh5-x44q-f6jhCGA-438j-4xvm-575xCGA-444g-h936-cg2vCGA-4g6j-gf2w-gfwcCGA-4gvq-32xm-7vqrCGA-4pxh-g9qh-x6jvCGA-52gx-h7v5-268hCGA-52j7-qg3w-vhq5CGA-575r-9m6g-v3fmCGA-59vp-f48r-wcwrCGA-5m8q-642r-h9g5CGA-5vhw-8w5x-6mf9CGA-5x4g-fg2r-rc93CGA-62hp-w8fh-f4gpCGA-63v2-58g6-55v4CGA-63vw-mj87-xxvfCGA-673w-685g-hjqfCGA-674h-p8p4-wxw2CGA-6v44-57q9-2vp4CGA-6w4p-fqh7-jq8rCGA-72wc-cpp7-c55hCGA-76v4-95wh-vfr6CGA-788r-m26f-cf9vCGA-78mf-6rmw-87jfCGA-7pgm-27wq-5hw8CGA-8472-v7cv-h3mgCGA-8729-2c38-h9p2CGA-88h8-6qwc-cvqvCGA-8c43-6h4f-57grCGA-8f8w-mf3v-qj5rCGA-8w99-w7jx-xjcpCGA-8wjp-6pwp-28m4CGA-92m4-hp2w-8cwjCGA-94jf-gh77-x43xCGA-972j-c3f6-fgpmCGA-975g-vj34-qpc4CGA-9769-hf3x-pv46CGA-9fph-p8rf-4qxpCGA-9hg6-q78h-hfqgCGA-9mj2-h57m-w595CGA-9q85-jr9m-v49fCGA-9qfc-h96p-q4cfCGA-c4fm-45r8-6cchCGA-cfc7-h45c-8m6cCGA-cfpp-vjxx-g5r2CGA-ch9v-5gh7-36qgCGA-cj53-8v7w-grw6CGA-cm6f-wg9c-mjjwCGA-cmj4-mmgp-649xCGA-cmmv-vg5f-35qwCGA-cp6j-6wxh-cm6rCGA-f2p7-q569-3wv4CGA-f82q-6xr9-vmpvCGA-f85r-rjrx-2jr3CGA-ff3m-2prp-rfjcCGA-fm97-3j5r-x3f6CGA-fq62-h4gw-h7vjCGA-fr25-88hj-3wwfCGA-fvmj-j3g7-4r5vCGA-fxx9-p483-wx4gCGA-g5x3-7f26-cq84CGA-gxf4-pv65-hc6vCGA-gxp5-7wx8-q7rfCGA-h678-279h-cvqpCGA-h79m-rqq4-6c5cCGA-hmxv-grmq-p8hwCGA-hq65-m5j7-c4p9CGA-hqrf-r25f-fjqhCGA-hvhx-r9pv-f36fCGA-hxpv-ggmp-gvvjCGA-j87q-4phq-85prCGA-jgqr-pvq4-fcgqCGA-jqm2-hrxh-723cCGA-jwjp-gjjm-q3hxCGA-jxhg-rjmr-mmpvCGA-m8hf-mhmp-v29fCGA-m9mm-5c6j-j3vcCGA-mcch-gqcx-736rCGA-mmjq-r637-v2v6CGA-mmrr-2279-mf8hCGA-mr32-8fm8-9h7hCGA-mrq9-cjw7-x3p8CGA-p354-576p-3mcrCGA-p47w-2vmr-qrm8CGA-p77j-r83w-44g3CGA-p9m9-qwpv-8wpmCGA-pfcf-vwwh-7mwqCGA-pm6x-wp97-wqc6CGA-ppwf-38jw-4686CGA-2372-7pqg-5p48CGA-257q-3f87-cc5cCGA-27fm-p6hv-5cr7CGA-2cxg-65r6-3hvpCGA-2fj4-845g-j46fCGA-2q6h-vcqr-2rj2CGA-2wv8-57fw-qq4qCGA-33m3-q4pr-3cjwCGA-357p-g9v6-h4w3CGA-36w7-7685-j3x9CGA-376v-rmr2-pr9xCGA-37qj-wf73-ppcjCGA-38g7-wm45-rm5hCGA-3cfp-44mp-xc86CGA-3gxc-pgv6-56v8CGA-434h-3mhp-54gfCGA-47gv-mx58-qp5cCGA-4g43-2qrm-gm8wCGA-4h6f-3gcm-rwqwCGA-4p2p-3f43-5vjmCGA-4wff-q8q3-629vCGA-53v8-g6fq-7q2mCGA-54h4-gcq6-g93gCGA-58g8-q766-j77jCGA-5cj3-xjx5-j9w7CGA-5cjx-7qh2-gpphCGA-5fw9-gjw3-r8hgCGA-5g39-4hm4-98x7CGA-5g69-64r7-wjf8CGA-5wg2-ccxx-7g3jCGA-682x-h559-wjr4CGA-6fcc-4v98-6mf7CGA-6h56-6938-gh9jCGA-6m74-3f54-6856CGA-6q7x-jgj6-fp9qCGA-6qg6-9gfq-2h72CGA-6vf4-32r9-67whCGA-6vqp-2x42-8q24CGA-762w-p92m-j3v2CGA-76r6-qjrg-5g6jCGA-7937-8x22-j8q7CGA-79qv-vww9-xvm5CGA-7cv6-9w6f-wx88CGA-7gf2-gh89-m4wcCGA-7wjj-pv6q-7gx6CGA-7x37-jmhp-vxwfCGA-827q-w8g4-9mpjCGA-8438-49wj-r6w9CGA-85v4-jj23-c2vpCGA-984v-q5g6-q8c7CGA-9mf9-54mm-728vCGA-9p4m-5hrf-3hrwCGA-9pwv-rxp2-v3j8CGA-9v9w-pv7x-fw26CGA-c4gq-4rr3-x65xCGA-c7hr-58v6-6jjmCGA-c85g-2q2c-4r4cCGA-c8xg-3f3h-jwfvCGA-c9r4-8wcw-9h53CGA-cf2r-m7wh-w48mCGA-cf7m-v37x-g5mgCGA-cgw3-47mv-hp7pCGA-crfr-c8pf-4q25CGA-cwq3-89m2-qrwhCGA-f2v2-2hv7-v5gmCGA-f64w-f9mv-rrvcCGA-fg23-j3hw-hgw7CGA-fmvh-76fv-3r5xCGA-fq73-6rw9-jff3CGA-fw4v-36jg-24phCGA-fxvp-qq29-g379CGA-g2c5-5qw9-h965CGA-gfcx-pp9p-33hjCGA-gh64-r98c-mq34CGA-gjm3-fcjw-8p5qCGA-gvhx-vqcp-47jmCGA-h48h-jx8q-pg82CGA-h636-hm2x-fp92CGA-h8g8-4g5c-ffpxCGA-hcfq-mh7x-wf5fCGA-hfgw-cg48-7wrfCGA-hgjh-6wjg-c842CGA-hhcx-9fwj-qg4rCGA-hjf7-792r-865wCGA-hr32-pqv3-64jvCGA-hr6c-p47w-ph2fCGA-j8j4-8vg4-57w9CGA-j967-722r-wx97CGA-jgpc-79p5-vhv6CGA-jh62-3836-752rCGA-jm8r-7p79-qvp2CGA-jrrq-rr69-pm59CGA-jxqw-pf53-pxjcCGA-m7r6-wwvf-pmh2CGA-m84m-3rwc-jx5qCGA-m9hp-g65c-m78hCGA-mf4r-x5hj-xc3pCGA-mv8p-xmp6-h4x4CGA-mwgq-prq7-g2h8CGA-p5g8-8793-55fhCGA-pf7q-r25v-g5g3CGA-pfm9-p7w3-w8v3CGA-pph5-q2jg-c3m3CGA-pvr7-qg7p-88crCGA-px54-r6vh-f647CGA-q2ww-3hjp-chpvCGA-q465-66p4-2wqpCGA-q485-57hg-xfpgCGA-q59j-7r47-43vvCGA-q5qp-r7p6-9cf6CGA-q672-v2cp-2w46CGA-q6fv-9h54-ff84CGA-q6hf-w977-xwv7CGA-q6hq-qpm4-r8g5CGA-q8gc-c2c2-cq67CGA-q935-mfp7-8fpjCGA-q9x5-rg63-v399CGA-qchf-95hv-rhm2CGA-qcwj-3gp9-69frCGA-qm26-jjp9-6hxvCGA-qp7x-mvq4-r477CGA-qqqc-5pj2-2mfvCGA-qx92-w8f6-7r96CGA-r624-x77w-6mh4CGA-r7f2-ccc2-r4jmCGA-rghp-7hhv-jvrmCGA-rj36-m8mq-76xhCGA-rmh3-mm8v-8xwmCGA-rmmm-hwqr-hp4gCGA-rpgw-x5w4-vv7vCGA-rqgp-7wxc-24f7CGA-rqpc-6rm2-j6whCGA-rqwp-qvpx-3m9gCGA-rrf9-3434-wr7mCGA-rx5g-rh5f-9mgfCGA-rx7h-gfmr-vq2hCGA-v43h-v9q4-7wj7CGA-v444-jw2x-wrjcCGA-v6hv-x32w-fpxfCGA-v77j-ff8f-hjjjCGA-v7pv-96g4-wfw8CGA-v85x-x5ch-39ppCGA-v8g3-8jvp-m6gqCGA-vc85-j374-985wCGA-vc8f-hx53-c97wCGA-vfhw-9g55-6387CGA-vg78-mwfm-fq9xCGA-vgr6-xwp6-hrx5CGA-vjm3-j252-9vc6CGA-vjmh-fgch-9mxrCGA-vjpr-vvgq-mj9wCGA-vmvg-f7qw-p9x2CGA-vpc5-f6qc-q48rCGA-vq44-c92f-jfhwCGA-vwm5-fm62-h2w8CGA-w2mg-9776-69m6CGA-w6f6-v84q-3h4wCGA-w6v8-8xm9-hc5hCGA-w7mg-4fg2-4frcCGA-wf2q-rpx4-7pm7CGA-wgv4-rgx2-v76hCGA-wh9g-rx6q-wv64CGA-whv6-p6cg-v9j7CGA-wjhv-8c7x-fw3cCGA-wmmw-27jx-7vhjCGA-wpx6-6j3q-whmrCGA-wr38-p5xq-74vcCGA-wrrh-mprq-7567CGA-ww66-66q5-9737CGA-wwph-9f7w-p7pfCGA-wwvr-4xpf-74x4CGA-wxpf-2p6p-2v97CGA-x23g-qm7r-p75qCGA-x2c5-735x-7pm9CGA-x2p9-jq53-rfmvCGA-x379-8xch-v24cCGA-x3gc-wxc8-4j4cCGA-x46j-6wv4-wmxxCGA-x5gg-fc96-3g23CGA-x6h4-w76f-3r5wCGA-x9m8-97r4-249vCGA-xc4p-3cr3-hmr4CGA-xh86-32hc-36cvCGA-xhq9-cq6p-jhvgCGA-xjqx-7jpp-2f5wCGA-xjw2-x2q4-m953CGA-xrhp-5q5v-rqxmCGA-xrx4-7x6f-hp7qCGA-xv55-m984-rp38CGA-xw4r-h6fj-2gp3
Advisory lineage Upstream: 0 Downstream: 20
Deferred
Published: 28 Jan 2025, 01:03
Last modified:30 Apr 2026, 03:56
Vulnerability Summary
Overall Risk (default)
medium
28/100 CVSS Score
7.1 HIGH
v3.1 (cve.org)
EPSS Score
0.32% LOW
0% probability +0.29%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
28 Jan 2025, 01:03
Published
Vulnerability first disclosed
30 Apr 2026, 03:56
Last Modified
Vulnerability information updated
Description
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
CVSS Metrics
- v4.0•HIGH•Score: 7.2CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- v3.1•HIGH•Score: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Trends
Current EPSS score: 0.32%• Percentile: 25%
Affected Systems
- chainguard•amass
< 4.2.0-r18
- chainguard•caddy
< 2.9.1-r3
- chainguard•caddy-fips
< 2.9.1-r3
- chainguard•caddy-man
< 2.9.1-r3
- chainguard•caddy-src
< 2.9.1-r3
- chainguard•cert-exporter
< 2.14.0-r5
- chainguard•cert-exporter-fips
< 2.14.0-r5
- chainguard•cluster-proportional-autoscaler
< 1.9.0-r5
- chainguard•cluster-proportional-autoscaler-compat
< 1.9.0-r5
- chainguard•cluster-proportional-autoscaler-fips
< 1.9.0-r3
- chainguard•crossplane-provider-family-gcp
< 1.11.2-r4
- chainguard•crossplane-provider-family-gcp-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-cloudplatform
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-cloudplatform-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-compute
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-compute-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-container
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-container-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-dns
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-dns-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-kms
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-kms-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-pubsub
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-pubsub-compat
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-storage
< 1.11.2-r4
- chainguard•crossplane-provider-gcp-storage-compat
< 1.11.2-r4
- chainguard•dgraph
< 24.0.5-r5
- chainguard•flux-image-reflector-controller
< 0.33.0-r8
- chainguard•flux-image-reflector-controller-fips
< 0.33.0-r6
- chainguard•flux-image-reflector-controller-iamguarded-compat
< 0.33.0-r8
- chainguard•flyte
< 1.14.1-r3
- chainguard•google-osconfig-agent
< 20250122.00-r2
- chainguard•grafana-mimir
< 2.15.0-r4
- chainguard•kube-bench-fips
< 0.10.0-r0
- chainguard•kubeflow
< 1.10.0-r3
- chainguard•kubeflow-access-management
< 1.10.0-r3
- chainguard•kubeflow-access-management-compat
< 1.10.0-r3
- chainguard•kubeflow-access-management-fips
< 1.10.0-r2
- chainguard•kubeflow-access-management-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook
< 1.10.0-r3
- chainguard•kubeflow-admission-webhook-compat
< 1.10.0-r3
- chainguard•kubeflow-admission-webhook-fips
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller
< 1.10.0-r3
- chainguard•kubeflow-notebook-controller-compat
< 1.10.0-r3
- chainguard•kubeflow-notebook-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-pipelines
< 2.4.0-r2
Showing first 50 affected entries in server-rendered view.
References (11)
- https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
- https://github.com/golang/glog/pull/74
- https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
- https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
- https://pkg.go.dev/vuln/GO-2025-3372
- https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-45339
- https://github.com/golang/glog
- https://security-tracker.debian.org/tracker/CVE-2024-45339
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45339.json