high 7.1

CVE-2024-45339 json

Vulnerability when creating log files in github.com/golang/glog

published 2025-01-28 21 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-0139 , GHSA-6wxm-mpqj-6jpf , GO-2025-3372

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Patch / fix

fixed in 2 distros 5 links 2

go github.com/golang/glog 1.2.4
github.com/golang/glog github.com/golang/glog 1.2.4

debian red hat suse opensuse azure linux

golang-glog Debian 14, Debian 13 1.2.4-1

debian advisories DEBIAN-CVE-2024-45339

jenkins ocp tools 4.12 2.479.3.1740464431-3.el8
jenkins-2-plugins ocp tools 4.12 4.12.1740464689-1.el8

red hat advisories RHSA-2025:2223

google-osconfig-agent Linux Micro 6.0 20260615.01-1.1
google-osconfig-agent Linux Micro 6.1 20250416.02-slfo.1.1_1.1
google-osconfig-agent SLE Module for Public Cloud 12 20250416.02-1.41.1
google-osconfig-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +4 more 20250416.02-150000.1.50.1
release-notes-susemanager Manager Server 4.3 4.3.15.2-150400.3.133.1
grafana Manager Client Tools 15 10.4.15-150000.1.71.1
grafana SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 10.4.15-150200.3.64.1
grafana Manager Client Tools 12 10.4.15-1.71.1

suse advisories SUSE-SU-2026:22242-1 SUSE-SU-2025:20746-1 SUSE-SU-2025:02150-1 SUSE-SU-2025:02149-1 SUSE-SU-2025:01985-1 SUSE-SU-2025:0624-1

velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
etcd-for-k8s1.32 openSUSE Tumbleweed 3.5.24-1.1
google-osconfig-agent openSUSE Tumbleweed 20250115.01-2.1
govulncheck-vulndb openSUSE Tumbleweed 0.0.20250128T150132-1.1

opensuse advisories openSUSE-SU-2026:11126-1 openSUSE-SU-2025:15764-1 openSUSE-SU-2025:14815-1 openSUSE-SU-2025:14710-1

vitess Azure Linux 3.0 19.0.4-4
sriov-network-device-plugin CBL-Mariner 2.0 3.6.2-8
vitess CBL-Mariner 2.0 17.0.7-4
sriov-network-device-plugin Azure Linux 3.0 3.7.0-3
glog CBL-Mariner 2.0 0.3.5-16

azure linux advisories AZL-56066 AZL-56069 AZL-56075 AZL-56078 AZL-56402

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/golang/glog#74 commit
github.com/golang/glog#74 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45339 updated 2026-10-22 cvss 7.1

github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog

Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-9-rhel9, multicluster-engine/managedcluster-import-controller-rhel8, multicluster-engine/managedcluster-import-controller-rhel9
affected: workaround, no fix available
Red Hat OpenShift AI (RHOAI) odh-notebook-controller-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Cluster Manager CLI ocm-cli-rhel9
affected: workaround, no fix available
Red Hat OpenShift Container Platform 4 kata-containers, openshift4/metallb-rhel9, openshift4/cnf-tests-rhel8, openshift4/ose-coredns-rhel9, openshift4/ose-cloud-event-proxy, openshift4/ose-ptp-rhel9-operator, +20 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Trusted Artifact Signer ec-rhel9
affected: workaround, no fix available
Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.479.3.1740464431-3.el8, jenkins-2-plugins 4.12.1740464689-1.el8
fixed: vendor fix RHSA-2025:2223
Red Hat OpenShift AI 2.16 rhoai v2.16.2-1742480582, rhoai v2.16.2-1742489233
fixed: vendor fix RHSA-2025:3368
Red Hat OpenShift AI 2.17 rhoai v2.17.0-1739196512, rhoai v2.17.0-1739206285
fixed: vendor fix RHSA-2025:1448

show 11 more

Red Hat OpenShift Container Platform 4.12 openshift4, openshift4 coredns-container-v4.12.0-202509270106.p2.g95d0029.assembly.stream.el8, openshift4 ose-metallb-container-v4.12.0-202509030106.p2.g3bc20ed.assembly.stream.el8, openshift4/ose-cloud-event-proxy v4.12.0-202507240129.p0.g96af0ec.assembly.stream.el8, openshift4/cloud-event-proxy-rhel8 v4.12.0-202507240129.p0.g96af0ec.assembly.stream.el8, openshift4 ose-ptp-operator-container-v4.12.0-202509030106.p2.gac0cba7.assembly.stream.el8, +15 more
fixed: vendor fix RHSA-2025:12325
Red Hat OpenShift Container Platform 4.13 openshift4 coredns-container-v4.13.0-202509021614.p2.gd3037cb.assembly.stream.el8, openshift4 ose-metallb-container-v4.13.0-202509021614.p2.ga7e83fb.assembly.stream.el8, openshift4 ose-ptp-operator-container-v4.13.0-202509021614.p2.g8c83fcc.assembly.stream.el8, openshift4 ose-linuxptp-daemon-container-v4.13.0-202509021614.p2.g87a564d.assembly.stream.el8, openshift4 ose-metallb-operator-container-v4.13.0-202509051317.p2.g55fb4e3.assembly.stream.el8, openshift4 sriov-network-webhook-container-v4.13.0-202509021614.p2.gfaf23ca.assembly.stream.el8, +9 more
fixed: vendor fix RHSA-2025:15674
Red Hat OpenShift Container Platform 4.14 openshift4, openshift4/ose-ptp-rhel9 v4.14.0-202508050936.p0.geaac187.assembly.stream.el9, openshift4/ose-ptp-operator v4.14.0-202508051136.p0.gbcb20b2.assembly.stream.el8, openshift4 coredns-container-v4.14.0-202508260116.p2.gd10f7ff.assembly.stream.el8, openshift4/cloud-event-proxy-rhel8 v4.14.0-202508051136.p0.gd173b63.assembly.stream.el8, openshift4/ose-cloud-event-proxy-rhel8 v4.14.0-202508051136.p0.gd173b63.assembly.stream.el8, +13 more
fixed: vendor fix RHSA-2025:13291
Red Hat OpenShift Container Platform 4.15 openshift4/ose-ptp-rhel9-operator v4.15.0-202507291037.p0.g18a931b.assembly.stream.el9, openshift4/ose-cloud-event-proxy-rhel9 v4.15.0-202507291037.p0.g1f58d5e.assembly.stream.el9, openshift4 ose-linuxptp-daemon-container-v4.15.0-202508190116.p2.g84be6ca.assembly.stream.el9, openshift4/ose-cloud-credential-operator v4.15.0-202507310036.p0.g73f2968.assembly.stream.el8, openshift4 ose-metallb-operator-container-v4.15.0-202509151014.p2.gc29431a.assembly.stream.el9, openshift4 sriov-network-webhook-container-v4.15.0-202508190116.p2.g1601062.assembly.stream.el9, +11 more
fixed: vendor fix RHSA-2025:12370
Red Hat OpenShift Container Platform 4.16 openshift4, openshift4/ose-ptp-rhel9 v4.16.0-202507281005.p0.g57fa466.assembly.stream.el9, openshift4/ose-ptp-rhel9-operator v4.16.0-202507281005.p0.g0b912e8.assembly.stream.el9, openshift4/ingress-node-firewall-rhel9 v4.16.0-202507302205.p0.gd214d48.assembly.stream.el9, openshift4/ose-cloud-event-proxy-rhel9 v4.16.0-202507281005.p0.gd9d72ba.assembly.stream.el9, openshift4 ose-metallb-operator-container-v4.16.0-202508201333.p2.gf3eacb4.assembly.stream.el9, +11 more
fixed: vendor fix RHSA-2025:13338
Red Hat OpenShift Container Platform 4.17 openshift4, openshift4/ose-ptp-rhel9-operator v4.17.0-202507291005.p0.gc836701.assembly.stream.el9, openshift4/ose-cloud-event-proxy-rhel9 v4.17.0-202507291005.p0.g9eeeeda.assembly.stream.el9, openshift4 ose-metallb-operator-container-v4.17.0-202508200911.p2.gd4c0017.assembly.stream.el9, openshift4/ose-sriov-network-webhook-rhel9 v4.17.0-202507291005.p0.gb5b5f7b.assembly.stream.el9, openshift4/ose-cloud-credential-rhel9-operator v4.17.0-202507291005.p0.gc426a2b.assembly.stream.el9, +10 more
fixed: vendor fix RHSA-2025:12439
Red Hat OpenShift Container Platform 4.18 openshift4, openshift4/ose-ptp-rhel9 v4.18.0-202507211933.p0.g3d5569f.assembly.stream.el9, openshift4/ose-ptp-rhel9-operator v4.18.0-202507211933.p0.gc2f9034.assembly.stream.el9, openshift4/ingress-node-firewall-rhel9 v4.18.0-202507291333.p0.gfe4f407.assembly.stream.el9, openshift4 ose-metallb-operator-container-v4.18.0-202508201347.p2.g4e1442f.assembly.stream.el9, openshift4/ose-sriov-network-webhook-rhel9 v4.18.0-202507211933.p0.gd72d6c0.assembly.stream.el9, +10 more
fixed: vendor fix RHSA-2025:13327
Red Hat OpenShift Container Platform 4.19 openshift4 ose-metallb-operator-container-v4.19.0-202508130123.p2.g3751aa0.assembly.stream.el9, openshift4/ose-cloud-credential-rhel9-operator v4.19.0-202507292137.p0.ga5d6267.assembly.stream.el9, openshift4 ose-network-metrics-daemon-container-v4.19.0-202508120121.p2.g89e4882.assembly.stream.el9, openshift4/ose-agent-installer-api-server-rhel9 v4.19.0-202507291138.p0.gbe6aa91.assembly.stream.el9, openshift4/ose-agent-installer-node-agent-rhel9 v4.19.0-202507291138.p0.g1753a85.assembly.stream.el9, openshift4/ose-aws-cluster-api-controllers-rhel9 v4.19.0-202507171007.p0.g778bbd2.assembly.stream.el9, +3 more
fixed: vendor fix RHSA-2025:12341
Red Hat OpenShift Container Platform 4.20 openshift4 ose-metallb-operator-container-v4.20.0-202509271248.p2.g95ac15a.assembly.stream.el9, openshift4 ose-network-metrics-daemon-container-v4.20.0-202509230043.p2.gb81340a.assembly.stream.el9, openshift4 ose-cloud-credential-operator-container-v4.20.0-202509230043.p2.gd391c0b.assembly.stream.el9, openshift4 sriov-dp-admission-controller-container-v4.20.0-202509230043.p2.g5101fce.assembly.stream.el9, openshift4 ose-agent-installer-api-server-container-v4.20.0-202509261556.p2.gc616cdc.assembly.stream.el9, openshift4 ose-agent-installer-node-agent-container-v4.20.0-202509251424.p2.g62dc63f.assembly.stream.el9, +1 more
fixed: vendor fix RHSA-2025:9563
Red Hat OpenShift AI (RHOAI) odh-training-operator-rhel8
not affected: component not present
Red Hat OpenShift AI 2.16 rhoai v2.16.1-1742921168, rhoai v2.16.2-1741882429, rhoai v2.16.2-1741963152, rhoai v2.16.2-1742487039, rhoai v2.16.2-1742487199, rhoai v2.16.2-1742487225, +20 more Red Hat OpenShift AI 2.17 rhoai v2.17.0-1739102527, rhoai v2.17.0-1739102539, rhoai v2.17.0-1739102637, rhoai v2.17.0-1739102645, rhoai v2.17.0-1739102747, rhoai v2.17.0-1739102748, +14 more Red Hat OpenShift Container Platform 4 cri-tools, openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, +7 more Red Hat OpenShift Container Platform 4.12 openshift4 v4.12.0-202509030106.p2.g007c2b1.assembly.stream.el8, openshift4 v4.12.0-202509030106.p2.g092b025.assembly.stream.el8, openshift4 v4.12.0-202509030106.p2.g0bd975e.assembly.stream.el8, openshift4 v4.12.0-202509030106.p2.g1a251f4.assembly.stream.el8, openshift4 v4.12.0-202509030106.p2.g32e6d25.assembly.stream.el8, openshift4 v4.12.0-202509030106.p2.g336d03e.assembly.stream.el8, +446 more Red Hat OpenShift Container Platform 4.13 openshift4 v4.13.0-202508300109.p2.g1a14e5c.assembly.stream.el8, openshift4 v4.13.0-202509021614.p2.g01bbb23.assembly.stream.el8, openshift4 v4.13.0-202509021614.p2.g01bfabb.assembly.stream.el8, openshift4 v4.13.0-202509021614.p2.g18c076b.assembly.stream.el8, openshift4 v4.13.0-202509021614.p2.g30fdccd.assembly.stream.el8, openshift4 v4.13.0-202509021614.p2.g312c5f2.assembly.stream.el8, +193 more Red Hat OpenShift Container Platform 4.14 openshift4, rhcos 414.92.202508041909-0, openshift4 v4.14.0-202508190123.p2.g23117c5.assembly.stream.el9, openshift4 v4.14.0-202508260116.p2.g03e5f40.assembly.stream.el8, openshift4 v4.14.0-202508260116.p2.g08fb27e.assembly.stream.el8, openshift4 v4.14.0-202508260116.p2.g09d6209.assembly.stream.el8, +447 more

+7 more productsfewer

Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202507301737-0, openshift4 v4.15.0-202508061316.p2.g52fc4b9.assembly.stream.el8, openshift4 v4.15.0-202508061316.p2.g870ade5.assembly.stream.el8, openshift4 v4.15.0-202508061316.p2.g87c23b5.assembly.stream.el8, openshift4 v4.15.0-202508061316.p2.g8d017b7.assembly.stream.el8, openshift4 v4.15.0-202508061316.p2.g9c64fe8.assembly.stream.el8, +674 more Red Hat OpenShift Container Platform 4.16 openshift4, rhcos 416.94.202507222002-0, rhcos 416.94.202508050040-0, openshift4 v4.16.0-202508201333.p2.g0338b3b.assembly.stream.el9, openshift4 v4.16.0-202508201333.p2.g0719399.assembly.stream.el9, openshift4 v4.16.0-202508201333.p2.g14571e8.assembly.stream.el9, +648 more Red Hat OpenShift Container Platform 4.17 openshift4, rhcos 417.94.202507291008-0, openshift4 v4.17.0-202508200911.p2.g06f3ae6.assembly.stream.el9, openshift4 v4.17.0-202508200911.p2.g08579e9.assembly.stream.el9, openshift4 v4.17.0-202508200911.p2.g0a9ed57.assembly.stream.el9, openshift4 v4.17.0-202508200911.p2.g19b025b.assembly.stream.el9, +457 more Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202507221927-0, rhcos 418.94.202508060022-0, openshift4 v4.18.0-202508201347.p2.g01fc505.assembly.stream.el9, openshift4 v4.18.0-202508201347.p2.g0a6f6eb.assembly.stream.el9, openshift4 v4.18.0-202508201347.p2.g1c7bc07.assembly.stream.el9, openshift4 v4.18.0-202508201347.p2.g1f8672a.assembly.stream.el9, +700 more Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202507230107-0, rhcos 4.19.9.6.202507300243-0, openshift4 v4.19.0-202508120121.p2.g06a66db.assembly.stream.el9, openshift4 v4.19.0-202508120121.p2.g3861c72.assembly.stream.el9, openshift4 v4.19.0-202508120121.p2.g3dfbb67.assembly.stream.el9, openshift4 v4.19.0-202508120121.p2.g3dfcfa1.assembly.stream.el9, +653 more Red Hat OpenShift Container Platform 4.20 openshift4 v4.20.0-202509230043.p2.g319efc9.assembly.stream.el9, openshift4 v4.20.0-202509230043.p2.g56f6158.assembly.stream.el9, openshift4 v4.20.0-202509230043.p2.g5cd04d6.assembly.stream.el9, openshift4 v4.20.0-202509230043.p2.g9cfa567.assembly.stream.el9, openshift4 v4.20.0-202509230043.p2.gb36788e.assembly.stream.el9, openshift4 v4.20.0-202509230043.p2.ge2bd260.assembly.stream.el9, +226 more Red Hat Trusted Artifact Signer tuf-server-rhel9, createctconfig-rhel9, trillian-createdb-rhel9, fulcio-createcerts-rhel9, ctlog-managectroots-rhel9, trillian-createtree-rhel9

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-04-29)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/golang/glog	<1.2.4	1.2.4

Affected products

github.com/golang/glog github.com/golang/glog

Classification

Weakness

CWE-377 DEPRECATED: Insecure Temporary File
CWE-61 UNIX Symbolic Link (Symlink) Following

References

github.com /golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
web, patch
github.com /golang/glog/pull/74
web, patch
groups.google.com /g/golang-announce/c/H-Q4ouHWyKs
web
owasp.org /www-community/vulnerabilities/Insecure_Temporary_File
web
pkg.go.dev /vuln/GO-2025-3372
web
lists.debian.org /debian-lts-announce/2025/02/msg00019.html
web
nvd.nist.gov /vuln/detail/CVE-2024-45339
advisory
github.com /golang/glog
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary