DEBIAN-CVE-2024-45339

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2024-45339
Downstream
DLA-4056-1
Published: 28 Jan 2025, 02:15
Last modified:28 Apr 2026, 20:28

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7.1 HIGH
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Jan 2025, 02:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:28
Last Modified
Vulnerability information updated

Description

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

CVSS Metrics

  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Systems

  • debian•golang-glog

    < 0.0~git20160126.23def4e-3+deb11u1 | all | < 1.2.4-1 | < 1.2.4-1

References (1)