Every CVE Search/ Get API key

CVE-2024-45339

Vulnerability when creating log files in github.com/golang/glog

7.1 HighFix available

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Jan 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.1

Vulnerability when creating log files in github.com/golang/glog

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
CVE-2024-45339
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
EUVDEUVD-2025-0139 7.1

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
EUVD-2025-0139
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-6wxm-mpqj-6jpf 4.1

Insecure Temporary File usage in github.com/golang/glog

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
GHSA-6wxm-mpqj-6jpf
CVSS 4.0
4.1 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-61, CWE-377
Updated
2026-11-02
NVD 7.1

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
CVE-2024-45339
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 7.1

Vulnerability when creating log files in github.com/golang/glog

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
CVE-2024-45339
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-45339 7.1

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
DEBIAN-CVE-2024-45339
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 27 moreShow less
OSVGHSA-6wxm-mpqj-6jpf 4.1

Insecure Temporary File usage in github.com/golang/glog

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
GHSA-6wxm-mpqj-6jpf
CVSS 4.0
4.1 MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-377, CWE-61
Updated
2026-11-02
OSVRHSA-2025:2223 8.0

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update

Record
RHSA-2025:2223
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-45339 7.1

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
UBUNTU-CVE-2024-45339
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-56066 No score

CVE-2024-45339 affecting package vitess for versions less than 19.0.4-4

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
AZL-56066
Updated
2026-11-02
OSVAZL-56069 No score

CVE-2024-45339 affecting package sriov-network-device-plugin for versions less than 3.6.2-8

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
AZL-56069
Updated
2026-11-02
OSVAZL-56075 No score

CVE-2024-45339 affecting package vitess for versions less than 17.0.7-4

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
AZL-56075
Updated
2026-11-02
OSVAZL-56078 No score

CVE-2024-45339 affecting package sriov-network-device-plugin for versions less than 3.7.0-3

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
AZL-56078
Updated
2026-11-02
OSVAZL-56379 No score

CVE-2024-45339 affecting package glog 0.3.5-16

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
AZL-56379
Updated
2026-11-05
OSVAZL-56402 No score

CVE-2024-45339 affecting package glog for versions less than 0.3.5-16

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
AZL-56402
Updated
2026-11-02
OSVGO-2025-3372 No score

Vulnerability when creating log files in github.com/golang/glog

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Record
GO-2025-3372
Updated
2026-11-02
OSVopenSUSE-SU-2025:14710-1 No score

govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14710-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14815-1 No score

google-osconfig-agent-20250115.01-2.1 on GA media

These are all security issues fixed in the google-osconfig-agent-20250115.01-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14815-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15764-1 No score

etcd-for-k8s1.32-3.5.24-1.1 on GA media

These are all security issues fixed in the etcd-for-k8s1.32-3.5.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15764-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11126-1 No score

velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11126-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20654-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Changes in grafana:

  • Update to version 11.6.11: Features and enhancements:

    • Alerting: Add limits for the size of expanded notification templates
    • Correlations: Remove support for org_id=0 Security:
    • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)

  • Update to version 11.6.10: Features and enhancements:

    • API: Add missing scope check on dashboards
    • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
    • Alerting: Fix a race condition panic in ResetStateByRuleUID

  • Update to version 11.6.9: Features and enhancements:

    • Plugins: Add PluginContext to plugins when scenes is disabled Bug fixes:
    • Alerting: Fix contacts point issues

  • Update to version 11.6.8: Bug fixes:

    • Alerting: Fix unmarshalling of GettableStatus to include time intervals

  • Update to version 11.6.7: Bug fixes:

    • Auth: Fix render user OAuth passthrough
    • LDAP Authentication: Fix URL to propagate username context as parameter
    • Plugins: Dependencies do not inherit parent URL for preinstall
    • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)

  • Update to version 11.6.6: Bug fixes:

    • Alerting: Fix copying of recording rule fields
    • Fix redirection after login when Grafana is served from subpath

  • Update to version 11.6.5: Features and enhancements:

    • Alerting: Bump alerting package to include change to NewTLSClient

  • Update to version 11.6.4: Features and enhancements:

    • StateTimeline: Add endTime to tooltip
    • Unified storage: Respect GF_DATABASE_URL override Bug fixes:
    • Alerting: Fix group interval override when adding new rules
    • Azure: Fix legend formatting
    • Azure: Fix resource name determination in template variable queries
    • Graphite: Fix annotation queries
    • Graphite: Fix date mutation
    • Graphite: Fix nested variable interpolation for repeated rows

  • Update to version 11.6.3: Security:

    • Fixes CVE-2025-3415

  • Update to version 11.6.2: Bug fixes:

    • Dashboard: Fixes issue with row repeats and first row
    • Graphite: Ensure template variables are interpolated correctly
    • Graphite: Fix Graphite series interpolation
    • Prometheus: Fix semver import path

  • Update to version 11.6.1: Features and enhancements:

    • DashboardScenePage: Correct slug in self referencing data links
    • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
    • Prometheus: Add support for cloud partners Prometheus data sources Bug fixes:
    • Alertmanager: Add Role-Based Access Control via reqAction Field
    • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
    • InfluxDB: Fix nested variable interpolation
    • LDAP test: Fix page crash
    • Org redirection: Fix linking between orgs

  • Upgrade to version 11.6.0: Features and enhancements:

    • Visualisations: One click links and actions
    • Annotations: Add cron syntax support
    • WebGL-powered geomaps for better performance
    • Alerting: Add alert rule version history Security:
    • API keys: Migrate API keys to service accounts at startup

  • CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)

  • CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)

  • CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)

  • CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)

  • Use forked wire from Grafana repository instead of external package (jsc#PED-14178).

  • Update to version 11.5.10: Security:

    • CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
    • CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) Features and enhancements:
    • Update to Go 1.25
    • Update to golang.org/x/net v0.45.0 Bug fixes:
    • Auth: Fix render user OAuth…
Record
openSUSE-SU-2026:20654-1
Updated
2026-11-02
OSVSUSE-SU-2025:01985-1 No score

Security update 4.3.15 for Multi-Linux Manager Server

This update fixes the following issues:

release-notes-susemanager:

  • Update to SUSE Manager 4.3.15.2
    • SUSE Manager 4.3 will transition to LTS after June 2025
    • CVE Fixed CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339 CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870 CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454 CVE-2025-3580, CVE-2025-4123, CVE-2024-47535
Record
SUSE-SU-2025:01985-1
Updated
2026-11-02
OSVSUSE-SU-2025:02149-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • Update to version 20250416.02 (bsc#1244304, bsc#1244503)
    • defaultSleeper: tolerate 10% difference to reduce test flakiness
    • Add output of some packagemanagers to the testdata
  • from version 20250416.01
    • Refactor OS Info package
  • from version 20250416.00
    • Report RPM inventory as YUM instead of empty SoftwarePackage when neither Zypper nor YUM are installed.
  • from version 20250414.00
    • Update hash computation algorithm
  • Update to version 20250320.00
    • Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1
  • from version 20250318.00
    • Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0
  • from version 20250317.02
    • Bump cel.dev/expr from 0.18.0 to 0.22.0
    • Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group
  • from version 20250317.01
    • Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0
  • from version 20250317.00
    • Add tests for retryutil package.
  • from version 20250306.00
    • Update OWNERS
  • from version 20250206.01
    • Use separate counters for pre- and post-patch reboots.
  • from version 20250206.00
    • Update owners
  • from version 20250203.00
    • Fix the vet errors for contants in logging
  • from version 20250122.00
    • change available package check
  • from version 20250121.00
    • Fix Inventory reporting e2e tests.
  • from version 20250120.00
    • fix e2e tests
  • Add -buildmode=pie to go build command line (bsc#1239948)
  • merged upstream
  • Renumber patches
Record
SUSE-SU-2025:02149-1
Updated
2026-11-02
OSVSUSE-SU-2025:02150-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • Update to version 20250416.02 (bsc#1244304, bsc#1244503)
    • defaultSleeper: tolerate 10% difference to reduce test flakiness
    • Add output of some packagemanagers to the testdata
  • from version 20250416.01
    • Refactor OS Info package
  • from version 20250416.00
    • Report RPM inventory as YUM instead of empty SoftwarePackage when neither Zypper nor YUM are installed.
  • from version 20250414.00
    • Update hash computation algorithm
  • Update to version 20250320.00
    • Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1
  • from version 20250318.00
    • Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0
  • from version 20250317.02
    • Bump cel.dev/expr from 0.18.0 to 0.22.0
    • Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group
  • from version 20250317.01
    • Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0
  • from version 20250317.00
    • Add tests for retryutil package.
  • from version 20250306.00
    • Update OWNERS
  • from version 20250206.01
    • Use separate counters for pre- and post-patch reboots.
  • from version 20250206.00
    • Update owners
  • from version 20250203.00
    • Fix the vet errors for contants in logging
  • from version 20250122.00
    • change available package check
  • from version 20250121.00
    • Fix Inventory reporting e2e tests.
  • from version 20250120.00
    • fix e2e tests
  • Add -buildmode=pie to go build command line (bsc#1239948)
  • merged upstream
  • Renumber patches
Record
SUSE-SU-2025:02150-1
Updated
2026-11-02
OSVSUSE-SU-2025:0297-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
    • GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
    • GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
    • GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
    • GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
    • GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
    • GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
    • GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
    • GO-2025-3422 CVE-2025-24354

  • Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3372 CVE-2024-45339
    • GO-2025-3373 CVE-2024-45341
    • GO-2025-3383 CVE-2024-45340
    • GO-2025-3420 CVE-2024-45336
    • GO-2025-3421 CVE-2025-22865

  • Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
    • GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
    • GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
    • GO-2025-3396 CVE-2024-52594
    • GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
    • GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
    • GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
    • GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
    • GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
    • GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

  • Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
    • GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
    • GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
    • GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
    • GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

  • Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
    • GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
    • GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
    • GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79
Record
SUSE-SU-2025:0297-1
Updated
2026-11-02
OSVSUSE-SU-2025:0429-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76
    • GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c
    • GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx

  • Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74
    • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g

  • Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3428 CVE-2025-22867
    • GO-2025-3447 CVE-2025-22866

  • Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3408
    • GO-2025-3448 GHSA-23qp-3c2m-xx6w
    • GO-2025-3449 GHSA-mx2j-7cmv-353c
    • GO-2025-3450 GHSA-w7wm-2425-7p2h
    • GO-2025-3454 GHSA-mj4v-hp69-27x5
    • GO-2025-3455 GHSA-vqv5-385r-2hf8

  • Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3451

  • Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2
    • GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v
    • GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg
    • GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c
    • GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2
    • GO-2025-3437 GHSA-274v-mgcv-cm8j
    • GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58
    • GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4
    • GO-2025-3443 GHSA-r3r4-g7hq-pq4f
    • GO-2025-3444 CVE-2024-35177
    • GO-2025-3445 CVE-2024-47770

  • Use standard RPM macros to unpack the source and populate a working directory. Fixes build with RPM 4.20.

  • Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425
    • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
    • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
    • GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf
    • GO-2025-3373 CVE-2024-45341
    • GO-2025-3383 CVE-2024-45340
    • GO-2025-3408
    • GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9
    • GO-2025-3420 CVE-2024-45336
    • GO-2025-3421 CVE-2025-22865
    • GO-2025-3424 CVE-2025-24369
    • GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g
    • GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56
Record
SUSE-SU-2025:0429-1
Updated
2026-11-02
OSVSUSE-SU-2025:0580-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to overwrite other sensitive files in a system. (bsc#1236560)
Record
SUSE-SU-2025:0580-1
Updated
2026-11-02
OSVSUSE-SU-2025:0611-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

  • CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to overwrite other sensitive files in a system. (bsc#1236560)
Record
SUSE-SU-2025:0611-1
Updated
2026-11-02
OSVSUSE-SU-2025:0622-1 No score

Security update for grafana

This update for grafana fixes the following issues:

grafana was updated from version 10.4.13 to 10.4.15:

  • Security issues fixed:
    • CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
    • CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
    • CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
    • CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
  • Other bugs fixed and changes:
    • Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
    • Added provisioning directories
    • Use /bin/bash in wrapper scripts
Record
SUSE-SU-2025:0622-1
Updated
2026-11-02
OSVSUSE-SU-2025:0623-1 No score

Security update for grafana

This update for grafana fixes the following issues:

grafana was updated from version 10.4.13 to 10.4.15:

  • Security issues fixed:
    • CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
    • CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
    • CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
    • CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
  • Other bugs fixed and changes:
    • Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
    • Added provisioning directories
    • Use /bin/bash in wrapper scripts
Record
SUSE-SU-2025:0623-1
Updated
2026-11-02
OSVSUSE-SU-2025:0624-1 No score

Security update for grafana

This update for grafana fixes the following issues:

grafana was updated from version 10.4.13 to 10.4.15:

  • Security issues fixed:
    • CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
    • CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
    • CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
    • CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
  • Other bugs fixed and changes:
    • Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
    • Added provisioning directories
    • Use /bin/bash in wrapper scripts
Record
SUSE-SU-2025:0624-1
Updated
2026-11-02
OSVSUSE-SU-2025:20746-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues:

Update to version 20250416.02 (bsc#1244304, bsc#1244503)

  • defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)
  • Add output of some packagemanagers to the testdata (#808)

From version 20250416.01:

  • Refactor OS Info package (#809)

From version 20250416.00:

  • Report RPM inventory as YUM instead of empty SoftwarePackage when neither Zypper nor YUM are installed. (#805)

From version 20250414.00:

  • Update hash computation algorithm (#799)

Update to version 20250320.00:

  • Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)
  • Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)
  • Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)
  • Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)
  • Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)
  • Add tests for retryutil package. (#795)
  • Update OWNERS (#794)
  • Use separate counters for pre- and post-patch reboots. (#788)
  • Update owners (#789)
  • Fix the vet errors for contants in logging (#786)
  • change available package check (#783)
  • Fix Inventory reporting e2e tests. (#782)
  • fix e2e tests (#781)
  • Add -buildmode=pie to go build command line (bsc#1239948)
Record
SUSE-SU-2025:20746-1
Updated
2026-11-02
OSVSUSE-SU-2026:22242-1 No score

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues

  • CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453).
  • CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251704).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
  • CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
  • CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171).
  • CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
  • CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923).

Changes for google-osconfig-agent:

  • Update to version 20260615.01
  • Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
  • from version 20260615.00
  • Add unit tests for ospatch_apt_upgrade.go (#938)
  • Update to version 20260611.00
  • Add unit tests for policies/policies.go PART 5 (#998)
  • from version 20260610.00
  • Add unit tests for policies/policies.go PART 4 (#997)
  • from version 20260609.02
  • squash commits (#936)
  • from version 20260609.01
  • Add unit tests for policies/policies.go PART 3 (#996)
  • from version 20260609.00
  • Add unit tests for policies/policies.go PART 2 (#991)
  • from version 20260602.01
  • Align format of dates and timestamp collected across Windows packages (#973)
  • from version 20260602.00
  • Add unit tests for config/config,go (#979)
  • from version 20260528.00
  • Bump github.com/containerd/containerd (#990)
  • from version 20260521.00
  • Cover agentconfig functionality by unit tests (#925)
  • from version 20260520.04
  • Add unit tests for policies/googet.go (#961)
  • Bump github.com/go-git/go-git/v5 (#987)
  • from version 20260520.02
  • Add unit tests for policies/yum.go (#952)
  • Add unit tests for policies/apt.go PART 3 (#951)
  • from version 20260520.00
  • Add unit tests for policies/zypper.go (#953)
  • from…
Record
SUSE-SU-2026:22242-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/golang/glog
Go
 before 1.2.4
1.2.4
vitess
Azure Linux:3
 before 19.0.4-4
19.0.4-4
sriov-network-device-plugin
Azure Linux:2
 before 3.6.2-8
3.6.2-8
vitess
Azure Linux:2
 before 17.0.7-4
17.0.7-4
sriov-network-device-plugin
Azure Linux:3
 before 3.7.0-3
3.7.0-3
glog
Azure Linux:3
 through 0.3.5-16 None known
glog
Azure Linux:2
 before 0.3.5-16
0.3.5-16
golang-glog
Debian:12
 All versions, plus listed versions
0.0~git20160126.23def4e-51.1.2-11.2.2-11.2.4-1
 None known
golang-glog
Debian:13
 before 1.2.4-1
1.2.4-1
golang-glog
Debian:14
 before 1.2.4-1
1.2.4-1
Show 38 moreShow less
Affected packages
PackageAffectedFixed
golang-glog
Debian:11
 before 0.0~git20160126.23def4e-3+deb11u1, plus listed versions
0.0~git20160126.23def4e-3
0.0~git20160126.23def4e-3+deb11u1
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 6 CVEs
 before 0:2.479.3.1740464431-3.el8
0:2.479.3.1740464431-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 6 CVEs
 before 0:4.12.1740464689-1.el8
0:4.12.1740464689-1.el8
release-notes-susemanager
SUSE:Manager Server 4.3
From an advisory covering 15 CVEs
 before 4.3.15.2-150400.3.133.1
4.3.15.2-150400.3.133.1
google-osconfig-agent
SUSE:Linux Enterprise Micro 5.5
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
openSUSE:Leap 15.6
 before 20250416.02-150000.1.50.1
20250416.02-150000.1.50.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 20250416.02-1.41.1
20250416.02-1.41.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 33 CVEs
 before 0.0.20250128T150132-150000.1.29.1
0.0.20250128T150132-150000.1.29.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 33 CVEs
 before 0.0.20250128T150132-150000.1.29.1
0.0.20250128T150132-150000.1.29.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 28 CVEs
 before 0.0.20250207T224745-150000.1.32.1
0.0.20250207T224745-150000.1.32.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 28 CVEs
 before 0.0.20250207T224745-150000.1.32.1
0.0.20250207T224745-150000.1.32.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 20250115.01-1.35.1
20250115.01-1.35.1
google-osconfig-agent
SUSE:Linux Enterprise Micro 5.5
 before 20250115.01-150000.1.44.1
20250115.01-150000.1.44.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP3
 before 20250115.01-150000.1.44.1
20250115.01-150000.1.44.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 20250115.01-150000.1.44.1
20250115.01-150000.1.44.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 20250115.01-150000.1.44.1
20250115.01-150000.1.44.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 20250115.01-150000.1.44.1
20250115.01-150000.1.44.1
google-osconfig-agent
openSUSE:Leap 15.6
 before 20250115.01-150000.1.44.1
20250115.01-150000.1.44.1
grafana
SUSE:Manager Client Tools 12
From an advisory covering 4 CVEs
 before 10.4.15-1.71.1
10.4.15-1.71.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 4 CVEs
 before 10.4.15-150200.3.64.1
10.4.15-150200.3.64.1
grafana
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 10.4.15-150200.3.64.1
10.4.15-150200.3.64.1
grafana
SUSE:Manager Client Tools 15
From an advisory covering 4 CVEs
 before 10.4.15-150000.1.71.1
10.4.15-150000.1.71.1
google-osconfig-agent
SUSE:Linux Micro 6.1
 before 20250416.02-slfo.1.1_1.1
20250416.02-slfo.1.1_1.1
google-osconfig-agent
SUSE:Linux Micro 6.0
From an advisory covering 23 CVEs
 before 20260615.01-1.1
20260615.01-1.1
golang-glog
Ubuntu:16.04:LTS
 All versions, plus listed versions
0+git20150214.44145f0-20+git20150801.fca8c88-1
 None known
golang-glog
Ubuntu:18.04:LTS
 All versions, plus listed versions
0+git20150801.fca8c88-10.0~git20160126.23def4e-1
 None known
golang-glog
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.0~git20160126.23def4e-3
 None known
golang-glog
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.0~git20160126.23def4e-30.0~git20160126.23def4e-5
 None known
golang-glog
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.0~git20160126.23def4e-51.1.2-1
 None known
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.0.20250128T150132-1.1
0.0.20250128T150132-1.1
google-osconfig-agent
openSUSE:Tumbleweed
 before 20250115.01-2.1
20250115.01-2.1
etcd-for-k8s1.32
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.5.24-1.1
3.5.24-1.1
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45339 is a high vulnerability (CVSS 7.1) in Github.com/golang/glog, published January 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in github.com/golang/glog 1.2.4.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 29 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open