CVE-2024-45339

Vulnerability when creating log files in github.com/golang/glog

High · published January 28, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
23.5
In the wild
Unconfirmed
What it is

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.5th percentile
Published
2025-01-28T01:03Z
EPSS history
Timeline
  • 28 JAN 01:03Z
    Vulnerability when creating log files in github.com/golang/glog
    cvelistv5