{"id":"CVE-2024-45339","aliases":["AZL-56066","AZL-56069","AZL-56075","AZL-56078","AZL-56379","AZL-56402","DEBIAN-CVE-2024-45339","DLA-4056-1","EUVD-2025-0139","GHSA-6wxm-mpqj-6jpf","GO-2025-3372","RHSA-2025:2223","SUSE-SU-2025:01985-1","SUSE-SU-2025:02149-1","SUSE-SU-2025:02150-1","SUSE-SU-2025:0297-1","SUSE-SU-2025:0429-1","SUSE-SU-2025:0580-1","SUSE-SU-2025:0611-1","SUSE-SU-2025:0622-1","SUSE-SU-2025:0623-1","SUSE-SU-2025:0624-1","SUSE-SU-2025:20746-1","SUSE-SU-2026:22242-1","UBUNTU-CVE-2024-45339","openSUSE-SU-2025:14710-1","openSUSE-SU-2025:14815-1","openSUSE-SU-2025:15764-1","openSUSE-SU-2026:11126-1","openSUSE-SU-2026:20654-1"],"status":"published","title":"Vulnerability when creating log files in github.com/golang/glog","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00318,"percentile":0.24958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377","CWE-61"],"published":"2025-01-28T00:47:30Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Go","package":"github.com/golang/glog","fixed_in":["1.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"vitess","fixed_in":["19.0.4-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"sriov-network-device-plugin","fixed_in":["3.6.2-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vitess","fixed_in":["17.0.7-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","fixed_in":["3.7.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"glog","fixed_in":["0.3.5-16"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-glog","fixed_in":["1.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-glog","fixed_in":["1.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"golang-glog","fixed_in":["0.0~git20160126.23def4e-3+deb11u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1","20250115.01-150000.1.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1","20250115.01-150000.1.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1","20250115.01-150000.1.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1","20250115.01-150000.1.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1","20250115.01-150000.1.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"google-osconfig-agent","fixed_in":["20250416.02-150000.1.50.1","20250115.01-150000.1.44.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","fixed_in":["20250416.02-1.41.1","20250115.01-1.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","fixed_in":["20250416.02-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","fixed_in":["20250115.01-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/golang/glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.0.4-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"sriov-network-device-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.7-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.5-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20160126.23def4e-5","1.1.2-1","1.2.2-1","1.2.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20160126.23def4e-3+deb11u1"}]}],"versions":["0.0~git20160126.23def4e-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/golang/glog","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/golang/glog","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.479.3.1740464431-3.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1740464689-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15.2-150400.3.133.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-150000.1.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-1.41.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-1.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-150000.1.44.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-150000.1.44.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-150000.1.44.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-150000.1.44.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-150000.1.44.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-150000.1.44.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-1.71.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-150200.3.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-150200.3.64.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.15-150000.1.71.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250416.02-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260615.01-1.1"}]}],"bundled":23},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0+git20150214.44145f0-2","0+git20150801.fca8c88-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0+git20150801.fca8c88-1","0.0~git20160126.23def4e-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20160126.23def4e-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20160126.23def4e-3","0.0~git20160126.23def4e-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-glog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20160126.23def4e-5","1.1.2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-1.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20250115.01-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.24-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49}],"products":[{"vendor":"github.com/golang/glog","product":"github.com/golang/glog"}],"references":[{"url":"https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2","tags":["web","fix","article","report"]},{"url":"https://github.com/golang/glog/pull/74","tags":["fix","web","article","report"]},{"url":"https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs","tags":["web","article","report"]},{"url":"https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File","tags":["web","article","report"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3372","tags":["web","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45339","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6wxm-mpqj-6jpf"},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45339.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45339","tags":["advisory"]},{"url":"https://github.com/golang/glog","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2223","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2316421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2324606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326047","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2223.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2342463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45339","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47072","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266","tags":["article"]},{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q","tags":["article"]},{"url":"https://x-stream.github.io/CVE-2024-47072.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47855","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47855","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wwcp-26wc-3fxm","tags":["advisory"]},{"url":"https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e","tags":["article"]},{"url":"https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52549","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52550","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52551","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3361","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501985-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4123","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239948","tags":["report"]},{"url":"https://bugzilla.suse.com/1244304","tags":["report"]},{"url":"https://bugzilla.suse.com/1244503","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502150-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24355","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250429-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24884","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250580-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236560","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250611-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250622-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235206","tags":["report"]},{"url":"https://bugzilla.suse.com/1235574","tags":["report"]},{"url":"https://bugzilla.suse.com/1236559","tags":["report"]},{"url":"https://bugzilla.suse.com/1236734","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250623-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250624-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520746-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212418","tags":["report"]},{"url":"https://bugzilla.suse.com/1212759","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622242-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210938","tags":["report"]},{"url":"https://bugzilla.suse.com/1236533","tags":["report"]},{"url":"https://bugzilla.suse.com/1251453","tags":["report"]},{"url":"https://bugzilla.suse.com/1251704","tags":["report"]},{"url":"https://bugzilla.suse.com/1260264","tags":["report"]},{"url":"https://bugzilla.suse.com/1262926","tags":["report"]},{"url":"https://bugzilla.suse.com/1264923","tags":["report"]},{"url":"https://bugzilla.suse.com/1265762","tags":["report"]},{"url":"https://bugzilla.suse.com/1266171","tags":["report"]},{"url":"https://bugzilla.suse.com/1266603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-45339","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GLG6TDNP2NZPYXB6GPK2TQLL6BGQNAKY/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://bugzilla.suse.com/1231844","tags":["report"]},{"url":"https://bugzilla.suse.com/1232975","tags":["report"]},{"url":"https://bugzilla.suse.com/1233343","tags":["report"]},{"url":"https://bugzilla.suse.com/1236510","tags":["report"]},{"url":"https://bugzilla.suse.com/1237671","tags":["report"]},{"url":"https://bugzilla.suse.com/1238703","tags":["report"]},{"url":"https://bugzilla.suse.com/1241683","tags":["report"]},{"url":"https://bugzilla.suse.com/1241687","tags":["report"]},{"url":"https://bugzilla.suse.com/1241809","tags":["report"]},{"url":"https://bugzilla.suse.com/1243672","tags":["report"]},{"url":"https://bugzilla.suse.com/1243714","tags":["report"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1246735","tags":["report"]},{"url":"https://bugzilla.suse.com/1246736","tags":["report"]},{"url":"https://bugzilla.suse.com/1250616","tags":["report"]},{"url":"https://bugzilla.suse.com/1251454","tags":["report"]},{"url":"https://bugzilla.suse.com/1251657","tags":["report"]},{"url":"https://bugzilla.suse.com/1254113","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-45339","title":"Vulnerability when creating log files in github.com/golang/glog","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T01:03:24.105Z","modified":"2026-04-30T03:56:03.352Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2025-0139","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T01:03:24Z","modified":"2026-04-30T03:56:03Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:05:19.116327Z"}],"ghsa":[{"id":"GHSA-6wxm-mpqj-6jpf","title":"Insecure Temporary File usage in github.com/golang/glog","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T17:29:03Z","modified":"2025-02-18T22:36:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-61","CWE-377"],"updated_at":"2026-11-02T14:38:32.275316Z"}],"nvd":[{"id":"CVE-2024-45339","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28.927Z","modified":"2026-06-17T07:54:03.643Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:43.581383Z"}],"osv":[{"id":"CVE-2024-45339","title":"Vulnerability when creating log files in github.com/golang/glog","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T01:03:24.105Z","modified":"2026-10-28T02:30:44.382274931Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"DEBIAN-CVE-2024-45339","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28.927Z","modified":"2026-11-02T12:03:14.210323515Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-6wxm-mpqj-6jpf","title":"Insecure Temporary File usage in github.com/golang/glog","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T17:29:03Z","modified":"2026-09-10T03:50:56.272730297Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-377","CWE-61"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"RHSA-2025:2223","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update","status":"published","published":"2025-03-05T10:03:13Z","modified":"2026-10-09T10:15:34Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"UBUNTU-CVE-2024-45339","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:00Z","modified":"2025-10-24T05:12:20Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"AZL-56066","title":"CVE-2024-45339 affecting package vitess for versions less than 19.0.4-4","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28Z","modified":"2026-09-22T05:34:53Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-56069","title":"CVE-2024-45339 affecting package sriov-network-device-plugin for versions less than 3.6.2-8","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28Z","modified":"2026-04-21T04:36:03.561018Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-56075","title":"CVE-2024-45339 affecting package vitess for versions less than 17.0.7-4","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28Z","modified":"2026-04-21T04:36:03.334563Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-56078","title":"CVE-2024-45339 affecting package sriov-network-device-plugin for versions less than 3.7.0-3","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28Z","modified":"2026-09-22T05:34:53Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-56379","title":"CVE-2024-45339 affecting package glog 0.3.5-16","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-56402","title":"CVE-2024-45339 affecting package glog for versions less than 0.3.5-16","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T02:15:28Z","modified":"2026-04-21T04:36:08.552375Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"DLA-4056-1","title":"golang-glog - security update","status":"published","published":"2025-02-17T00:00:00Z","modified":"2026-03-09T01:22:17.694766Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"GO-2025-3372","title":"Vulnerability when creating log files in github.com/golang/glog","description":"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.","status":"published","published":"2025-01-28T00:47:30Z","modified":"2026-02-04T04:04:12.085948Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14710-1","title":"govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-29T00:00:00Z","modified":"2026-02-04T03:35:07.287798Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14815-1","title":"google-osconfig-agent-20250115.01-2.1 on GA media","description":"These are all security issues fixed in the google-osconfig-agent-20250115.01-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-18T00:00:00Z","modified":"2026-02-04T02:51:37.256098Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15764-1","title":"etcd-for-k8s1.32-3.5.24-1.1 on GA media","description":"These are all security issues fixed in the etcd-for-k8s1.32-3.5.24-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-25T00:00:00Z","modified":"2026-03-23T04:54:10.196331Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20654-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- Update to version 11.6.11:\n  Features and enhancements:\n  * Alerting: Add limits for the size of expanded notification\n    templates\n  * Correlations: Remove support for org_id=0\n  Security:\n  * CVE-2026-21722: Public dashboards annotations: use dashboard\n    timerange if time selection disabled (bsc#1258136)\n\n- Update to version 11.6.10:\n  Features and enhancements:\n  * API: Add missing scope check on dashboards\n  * Avatar: Require sign-in, remove queue, respect timeout\n  Bug fixes:\n  * Alerting: Fix a race condition panic in ResetStateByRuleUID\n\n- Update to version 11.6.9:\n  Features and enhancements:\n  * Plugins: Add PluginContext to plugins when scenes is disabled\n  Bug fixes:\n  * Alerting: Fix contacts point issues\n\n- Update to version 11.6.8:\n  Bug fixes:\n  * Alerting: Fix unmarshalling of GettableStatus to include time\n    intervals\n\n- Update to version 11.6.7:\n  Bug fixes:\n  * Auth: Fix render user OAuth passthrough\n  * LDAP Authentication: Fix URL to propagate username context as\n    parameter\n  * Plugins: Dependencies do not inherit parent URL for preinstall\n  * URLParams: Stringify true values as key=true always (fixes\n    issues with variables with true value)\n\n- Update to version 11.6.6:\n  Bug fixes:\n  * Alerting: Fix copying of recording rule fields\n  * Fix redirection after login when Grafana is served from subpath\n\n- Update to version 11.6.5:\n  Features and enhancements:\n  * Alerting: Bump alerting package to include change to\n    NewTLSClient\n\n- Update to version 11.6.4:\n  Features and enhancements:\n  * StateTimeline: Add endTime to tooltip\n  * Unified storage: Respect GF_DATABASE_URL override\n  Bug fixes:\n  * Alerting: Fix group interval override when adding new rules\n  * Azure: Fix legend formatting\n  * Azure: Fix resource name determination in template variable\n    queries\n  * Graphite: Fix annotation queries\n  * Graphite: Fix date mutation\n  * Graphite: Fix nested variable interpolation for repeated rows\n\n- Update to version 11.6.3:\n  Security:\n  * Fixes CVE-2025-3415\n\n- Update to version 11.6.2:\n  Bug fixes:\n  * Dashboard: Fixes issue with row repeats and first row\n  * Graphite: Ensure template variables are interpolated correctly\n  * Graphite: Fix Graphite series interpolation\n  * Prometheus: Fix semver import path\n\n- Update to version 11.6.1:\n  Features and enhancements:\n  * DashboardScenePage: Correct slug in self referencing data links\n  * GrafanaUI: Use safePolygon close handler for interactive\n    tooltips instead of a delay\n  * Prometheus: Add support for cloud partners Prometheus data\n    sources\n  Bug fixes:\n  * Alertmanager: Add Role-Based Access Control via reqAction Field\n  * GrafanaUI: Remove blurred background from overlay backdrops to\n    improve performance\n  * InfluxDB: Fix nested variable interpolation\n  * LDAP test: Fix page crash\n  * Org redirection: Fix linking between orgs\n\n- Upgrade to version 11.6.0:\n  Features and enhancements:\n  * Visualisations: One click links and actions\n  * Annotations: Add cron syntax support\n  * WebGL-powered geomaps for better performance\n  * Alerting: Add alert rule version history\n  Security:\n  * API keys: Migrate API keys to service accounts at startup\n\n- CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)\n- CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)\n- CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n- CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)\n\n- Use forked wire from Grafana repository instead of external\n  package (jsc#PED-14178).\n\n- Update to version 11.5.10:\n  Security:\n  * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)\n  * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)\n  Features and enhancements:\n  * Update to Go 1.25\n  * Update to golang.org/x/net v0.45.0\n  Bug fixes:\n  * Auth: Fix render user OAuth passthrough.\n  * LDAP Authentication: Fix URL to propagate username context as\n                         parameter.\n  * Plugins: Dependencies do not inherit parent URL for preinstall.\n\n- Update to version 11.5.9:\n  * Security:\n    CVE-2025-11065: Fix sensitive information leak in logs\n                    (bsc#1250616)\n  * Features and enhancements:\n    Auditing: Document new options for recording datasource query\n              request/response body.\n  * Bug fixes:\n    Login: Fix redirection after login when Grafana is served from\n           subpath.\n\n- Update to version 11.5.8:\n  * No relevant changes\n\n- Update to version 11.5.7:\n  * Security:\n    CVE-2025-6023: Fix cross-site-scripting via scripted dashboards (bsc#1246735)\n    CVE-2025-6197: Fix open redirect in organization switching (bsc#1246736)\n  * Bug fixes:\n    Azure: Fix legend formatting.\n    Azure: Fix resource name determination in template variable\n           queries.\n\n- Update to version 11.5.6:\n  * Security:\n    CVE-2025-3415: Fix exposure of DingDing alerting integration\n                   URL to Viewer level users (bsc#1245302)\n\n- Update to version 11.5.5 (jsc#PED-12918):\n  * Security:\n    CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).\n    CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)\n    CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).\n\n- Update to version 11.5.4:\n  * Security:\n    CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.\n    CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).\n    CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).\n  * Features and enhancements:\n    Azure Monitor: Filter namespaces by resource group.\n    Azure: Add support for custom namespace and custom metrics\n           variable queries.\n    Azure: Resource picker improvements.\n    Azure: Support more complex variable interpolation.\n    Azure: Variable editor and resource picker improvements.\n    DashboardScenePage: Correct slug in self referencing data\n                        links.\n    Prometheus: Add support for cloud partners Prometheus data\n                sources.\n  * Bug fixes:\n    InfluxDB: Fix nested variable interpolation.\n    LDAP test: Fix page crash.\n\n- Update to version 11.5.3:\n  * Security:\n    CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).\n  * Bug fixes:\n    Alerting: Fix token-based Slack image upload to work with\n              channel names.\n    Auth: Fix AzureAD config UI's ClientAuthentication dropdown.\n    Dashboard: Fix the unintentional time range and variables\n               updates on saving.\n    Dashboards: Fix missing v/e/i keybindings to return back to\n                dashboard.\n    InfluxDB: Improve handling of template variables contained in\n              regular expressions (InfluxQL).\n    Org redirection: Fix linking between orgs.\n\n- Update to version 11.5.2:\n  * Bug fixes:\n    Alerting: Allow specifying uid for new rules added to groups.\n    Alerting: Call RLock() before reading sendAlertsTo map.\n    Auth: Fix redirect with JWT auth URL login.\n    AuthN: Refetch user on \"ErrUserAlreadyExists\".\n    Azure: Correctly set application insights resource values.\n    DashboardList: Throttle the re-renders.\n    Dashboards: Bring back scripted dashboards.\n    Plugin Metrics: Eliminate data race in plugin metrics\n                    middleware.\n    RBAC: Don't check folder access if annotationPermissionUpdate\n          FT is enabled.\n\n- Update to version 11.5.1:\n  * Bug fixes:\n    CodeEditor: Fix cursor alignment.\n    TransformationFilter: Include transformation outputs in\n                          transformation filtering options.\n\n- Upgrade to version 11.5.0:\n  * Breaking changes:\n    Loki: Default to /labels API with query param instead of\n          /series API.\n  * Features and enhancements:\n    Extended Cloud Migration Assistent support for plugins and\n      alerts.\n    Redesigned filters for dashboards.\n    New regular expression option for Extract fields\n      transformation.\n    Redesigned sharing experience in Dashboards.\n    Customizable shareable dashboard panel images.\n    RBAC for alerting notifications and notification policies.\n    Add support for Elasticsearch cross-cluster search.\n    Time series macro support in visual query builder for SQL data\n      sources.\n    OAuth and SAML session handling improvements.\n    Plugin Frontend Sandbox for additiona security.\n    Renamed Public dashboards to Shared dashboards.\n\n- Update to version 11.4.1:\n  * Bug fixes:\n    Alerting: AlertingQueryRunner should skip descendant nodes of\n              invalid queries.\n    Alerting: Fix alert rules unpausing after moving rule to\n              different folder.\n    Alerting: Fix label escaping in rule export.\n    Alerting: Fix slack image uploading to use new api.\n    Azure/GCM: Improve error display.\n    Dashboards: Fix issue where filtered panels would not react to\n                variable changes.\n    Dashboards: Fixes issue with panel header showing even when\n                hide time override was enabled.\n    Dashboards: Fixes week relative time ranges when weekStart was\n                changed.\n    Dashboards: Panel react for timeFrom and timeShift changes\n                using variables.\n    DateTimePicker: Fixes issue with date picker showing invalid\n                    date.\n    Fix: Add support for datasource variable queries.\n    InfluxDB: Adhoc filters can use template vars as values.\n    LibraryPanel: Fallback to panel title if library panel title is\n                  not set.\n\n- Upgrade to version 11.4.0:\n  * Features and enhancements:\n    Cloudwatch: OpenSearch PPL and SQL support in Logs Insights.\n\n- Update to version 11.3.1:\n  * Features and enhancements:\n    Alerting: Make context deadline on AlertNG service startup\n              configurable.\n    MigrationAssistant: Restrict dashboards, folders and\n                        datasources by the org id of the signed in\n                        user.\n    User: Check SignedInUser OrgID in RevokeInvite.\n  * Bug fixes:\n    Alerting: Fix escaping of silence matchers in utf8 mode.\n    Alerting: Fix overflow for long receiver names.\n    Alerting: Fix saving advanced mode toggle state in the alert\n              rule editor.\n    Alerting: Fix setting datasource uid, when datasource is string\n              in old version.\n    Alerting: Force refetch prom rules when refreshing panel.\n    Anonymous User: Adds validator service for anonymous users.\n    Azure Monitor: Support metric namespaces fallback.\n    Azure: Fix duplicated traces in multi-resource trace query.\n    Azure: Handle namespace request rejection.\n    CloudWatch: Interpolate region in log context query.\n    Dashboard datasource: Return annotations as series when query\n                          topic is \"annotations\".\n    Dashboard: Append orgId to URL.\n    Dashboards: Fixes performance issue expanding a row.\n    Flame Graph: Fix crash when it receives empty data.\n    Folders: Add admin permissions upon creation of a folder w. SA.\n    Folders: Don't show error pop-up if the user can't fetch the\n             root folder.\n    Migration: Remove table aliasing in delete statement to make it\n               work for mariadb.\n    ServerLock: Fix pg concurrency/locking issue.\n    Service Accounts: Run service account creation in transaction.\n    Table: Fix text wrapping applying to wrong field.\n    Unified Storage: Use ssl_mode instead of sslmode.\n\n- Update to version 11.3.0+security-01:\n  * Security:\n    CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)\n\n- Upgrade to version 11.3.0:\n  * Features and enhancements:\n    View mode and Edit mode are generally available.\n    Template variables and the time range picker remain visible\n      when scrolling.\n    Added timezone parameter in Grafana URL.\n    Kiosk mode displays dashboard controls.\n    Auto-formatted table cell values in Cell Inspect.\n    Allow adding actions to canvas elements.\n    Legend support in bar gauge visualizations.\n    Apply the same binary transformation to all the number fields\n      in a given table at once.\n    Add support for data links and actions in several\n      visualizations.\n    The Explore Logs plugin is installed by default.\n    Added correlations to external URLs in Explore.\n    Simplified query section for alert rule creation.\n    Introduced recording rules for Grafana-managed alerts.\n    GitHub App authentication for the GitHub data source.\n    Improved subfolder creation flow.\n    Redesigned plugin details page.\n    Added UI for LDAP configuration.\n    Added RBAC support in Plugins.\n\n- Update to version 11.2.2+security-01:\n  * Bug fix:\n    SQL Expressions: Fixes CVE-2024-9264 (bsc#1231844)\n\n- Update to version 11.2.2:\n  * Features and enhancements:\n    Data sources: Hide the datasource redirection banner for users\n                  who can't interact with data sources.\n  * Bug fixes:\n    Alerting: Fix preview of silences when label name contains\n              spaces.\n    Alerting: Make query wrapper match up datasource UIDs if\n              necessary.\n    AzureMonitor: Improve resource picker efficiency.\n    AzureMonitor: Remove Basic Logs retention warning.\n    CloudWatch: Fix segfault when migrating legacy queries.\n    DashboardScene: Fix broken error handling and error rendering.\n    Plugins: Avoid returning 404 for AutoEnabled apps.\n\n- Update to version 11.2.1:\n  * Features and enhancements:\n    Alerting: Support for optimistic concurrency in priovisioning\n              Tempate API.\n    Logs panel: Enable displayedFields in dashboards and apps.\n    State timeline: Add pagination support.\n  * Bug fixes:\n    Authn: No longer hash service account token twice during\n           authentication.\n    CloudMigrations: Fix snapshot creation on Windows systems.\n    DashGPT: Fixes issue with generation on Safari.\n    Dashboard: Fix Annotation runtime error when a data source does\n               not support annotations.\n    Grafana SQL: Fix broken import in NumberInput component.\n    Logs: Show older logs button when infinite scroll is enabled\n          and sort order is descending.\n    RBAC: Fix an issue with server admins not being able to manage\n          users in orgs that they don't belong to.\n    Templating: Fix searching non-latin template variables.\n\n- Upgrade to version 11.2.0:\n  * Features and enhancements:\n    Grafana Cloud Migration Assistant is in public preview.\n    Added navigation bookmarks.\n    Added template variables support in some transformations.\n    Introduced Transpose transformation.\n    Group to nested tables is now generally available.\n    Format string transformation is now generally available.\n    New cumulative and window calculations available in Add field\n      from calculation.\n    Canvas: Standardized tooltips.\n    Canvas: Allow adding data links without using an override.\n    Canvas: Allow opening data links with a single click.\n    Canvas: Add the ability to control the order in which data\n            links are displayed.\n    Added pagination support for state timeline.\n    Centralized alert history page.\n    Grafana Explore now allows for logs filtering and pinning in\n      content outline.\n    Added forward direction search for Loki.\n    Added Cloudwatch Metric Insights cross account observability\n      support.\n    Added Yugabyte data source.\n    Map org-specific user roles from your OAuth provider.\n    Better SAML integration for Azure AD.\n    API support for LDAP configuration (experimental).\n    OpenID Connect Discovery URL for Generic OAuth.\n\n- Update to version 11.1.5:\n  * Bug fixes:\n    Alerting: Fix permissions for prometheus rule endpoints.\n    Alerting: Fix persisting result fingerprint that is used by\n              recovery threshold.\n    RBAC: Fix an issue with server admins not being able to manage\n          users in orgs that they don't belong to.\n    Snapshots: Fix panic when snapshot_remove_expired is true.\n    VizTooltip: Fix positioning at bottom and right edges on\n                mobile.\n    Plugins: Fix QueryField typeahead missing background color.\n\n- Update to version 11.1.3:\n  * Bug fix:\n    RBAC: Allow plugins to use scoped actions.\n\n- Update to version 11.1.1:\n  * Bug fixes:\n    Alerting: Skip fetching alerts for unsaved dashboards.\n    Alerting: Support utf8_strict_mode: false in Mimir.\n    Scenes: Fixes issue with panel repeat height calculation.\n    Table Panel: Fix Image hover without datalinks.\n    Tempo: Fix grpc streaming support over pdc-agent.\n    RBAC: Allow plugins to use scoped actions.\n\n- Upgrade to version 11.1.0:\n  * Security:\n    CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)\n  * Features and improvements:\n    Allow table cell text wrapping.\n    Added stat visualization percent change color mode options.\n    XA chart is generally available.\n    Redesigned settings page for Alerting.\n    Added alerting template selector.\n    Added OAuth2 to HTTP settings for vanilla Alertmanager / Mimir.\n    Improved paused alert visibility.\n    Rule-specific silences with permissions.\n    Support for AWS SNS integration in Grafana-managed alerts.\n    Added GeoMap and panel shortcut keyboard support.\n    Accessability headings improvements.\n    Added reduced motion support.\n\n- Update to version 11.0.1:\n  * Breaking changes:\n    If you had selected your language as \"Portugu�s Brasileiro\"\n    previously, this will be reset. You have to select it again in\n    your Preferences for the fix to be applied and the translations\n    will then be shown.\n  * Bug fixes:\n    Echo: Suppress errors from frontend-metrics API call failing.\n    Analytics: Fix ApplicationInsights integration.\n    DashboardScene: Fixes issue removing override rule.\n    BrowseDashboards: Prepend subpath to New Browse Dashboard\n                      actions.\n    Alerting: Fix rule storage to filter by group names using\n              case-sensitive comparison.\n    RBAC: List only the folders that the user has access to.\n    DashboardScene: Fixes lack of re-render when updating field\n                    override properties.\n    DashboardScene: Fixes inspect with transforms issue.\n    AzureMonitor: Fix bug detecting app insights queries.\n    Access Control: Clean up permissions for deprovisioned data\n                    sources.\n    Loki: Fix editor history in wrong order.\n    SSE: Fix threshold unmarshal to avoid panic.\n    LibraryPanels/RBAC: Ignore old folder permission check when\n                        deleting/patching lib panel.\n    Dashboards: Correctly display Admin access to dashboards in the\n                UI.\n    LogsTable: Fix default sort by time.\n    Alerting: Fix rules deleting when reordering whilst filtered.\n    Alerting: Fix typo in JSON response for rule export.\n    CloudMonitoring: Fix query type selection issue.\n    Alerting: Fix scheduler to sort rules before evaluation.\n    DashboardScene: Skip panel repeats when values are the same.\n    Alerting: Do not store series values from past evaluations in\n              state manager for no reason.\n    DashboardScene: Fixing major row repeat issues.\n    DashboardScene: Fixes checkbox orienation in save forms.\n\n- Upgrade to version 11.0.0:\n  * Breaking changes:\n    AngularJS support is turned off by default.\n    Legacy alerting is entirely removed.\n    Subfolders cause very rare issues with folders which have\n      slashes in their names.\n    The input data source is removed.\n    Data sources: Responses which are associated with hidden\n      queries will be removed (filtered) by Grafana.\n    The URL which is generated when viewing an individual repeated\n      panel has changed.\n    React Router is deprecated.\n    The grafana/e2e testing tool is deprecated.\n  * Features and enhancements:\n    Introduced Explore Metrics (public preview) and Explore Logs\n      (experimental).\n    Introduced edit mode to provide an easier way to discover and\n      interact with the dashboard edit exprerience.\n    Fixed positioning of template variables and time picker.\n    Introduced dashboard subfolders.\n    Use AI to generate titles and descriptions for panels and\n      dashboards.\n    Canvas: Enhanced flowcharting functionality.\n    Canvas: Universal data link support.\n    Canvas: Added infinite panning editor option.\n    Added colored table rows with conditional formatting.\n    Set threshold colors in the Config from query transformation.\n    Substring matcher added to the Filter by value transformation.\n    Keep Last State for Grafana Managed Alerting.\n    Redesigned alert detail view.\n    The Alerting Provisioning HTTP API has been updated to enforce\n      RBAC.\n    Removed old Tempo Search and Loki Search.\n    MSSQL: Windows Active Directory (Kerberos) authentication.\n    New strong password policy.\n\n- CVE-2025-27144: Fix Go JOSE's Parsing Vulnerability (bsc#1237671)\n- CVE-2024-51744: Fix bad documentation of error handling in ParseWithClaims (bsc#1232975)\n- CVE-2024-45339: Fix vulnerability when creating log files (bsc#1236559)\n\n- Update to version 10.4.15:\n  * Bugfixes\n    CVE-2024-11741: Fix the Grafana Alerting VictorOps integration\n    (bsc#1236734)\n    Chore: Bump dependency golang.org/x/crypto to v0.31.0\n\n- Update to version 10.4.14:\n  * Bugfixes\n    Alerting: Do not fetch Orgs if the user is authenticated by\n              apikey/sa or render key\n","status":"published","published":"2026-04-29T16:12:10Z","modified":"2026-05-19T06:28:55.298483241Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:01985-1","title":"Security update 4.3.15 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.15.2\n  * SUSE Manager 4.3 will transition to LTS after June 2025\n  * CVE Fixed\n    CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339\n    CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870\n    CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454\n    CVE-2025-3580, CVE-2025-4123, CVE-2024-47535\n\n","status":"published","published":"2025-06-18T02:07:51Z","modified":"2026-02-04T02:41:15.743433Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02149-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- Update to version 20250416.02 (bsc#1244304, bsc#1244503)\n  * defaultSleeper: tolerate 10% difference to reduce test flakiness\n  * Add output of some packagemanagers to the testdata\n- from version 20250416.01\n  * Refactor OS Info package\n- from version 20250416.00\n  * Report RPM inventory as YUM instead of empty SoftwarePackage\n    when neither Zypper nor YUM are installed.\n- from version 20250414.00\n  * Update hash computation algorithm\n- Update to version 20250320.00\n  * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1\n- from version 20250318.00\n  * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0\n- from version 20250317.02\n  * Bump cel.dev/expr from 0.18.0 to 0.22.0\n  * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group\n- from version 20250317.01\n  * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0\n- from version 20250317.00\n  * Add tests for retryutil package.\n- from version 20250306.00\n  * Update OWNERS\n- from version 20250206.01\n  * Use separate counters for pre- and post-patch reboots.\n- from version 20250206.00\n  * Update owners\n- from version 20250203.00\n  * Fix the vet errors for contants in logging\n- from version 20250122.00\n  * change available package check\n- from version 20250121.00\n  * Fix Inventory reporting e2e tests.\n- from version 20250120.00\n  * fix e2e tests\n- Add -buildmode=pie to go build command line (bsc#1239948)\n- merged upstream\n- Renumber patches\n","status":"published","published":"2025-06-27T05:22:03Z","modified":"2026-02-04T04:17:53.102833Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02150-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- Update to version 20250416.02 (bsc#1244304, bsc#1244503)\n  * defaultSleeper: tolerate 10% difference to reduce test flakiness\n  * Add output of some packagemanagers to the testdata\n- from version 20250416.01\n  * Refactor OS Info package\n- from version 20250416.00\n  * Report RPM inventory as YUM instead of empty SoftwarePackage\n    when neither Zypper nor YUM are installed.\n- from version 20250414.00\n  * Update hash computation algorithm\n- Update to version 20250320.00\n  * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1\n- from version 20250318.00\n  * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0\n- from version 20250317.02\n  * Bump cel.dev/expr from 0.18.0 to 0.22.0\n  * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group\n- from version 20250317.01\n  * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0\n- from version 20250317.00\n  * Add tests for retryutil package.\n- from version 20250306.00\n  * Update OWNERS\n- from version 20250206.01\n  * Use separate counters for pre- and post-patch reboots.\n- from version 20250206.00\n  * Update owners\n- from version 20250203.00\n  * Fix the vet errors for contants in logging\n- from version 20250122.00\n  * change available package check\n- from version 20250121.00\n  * Fix Inventory reporting e2e tests.\n- from version 20250120.00\n  * fix e2e tests\n- Add -buildmode=pie to go build command line (bsc#1239948)\n- merged upstream\n- Renumber patches\n","status":"published","published":"2025-06-27T05:22:19Z","modified":"2026-02-04T02:54:41.710783Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:0297-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n  * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n  * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n  * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n  * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n  * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n  * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n  * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n  * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3372 CVE-2024-45339\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n  * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n  * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n  * GO-2025-3396 CVE-2024-52594\n  * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n  * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n  * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n  * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n  * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n  * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n  * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n  * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n  * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n  * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n  * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n  * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n  * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n","status":"published","published":"2025-01-30T14:03:37Z","modified":"2026-02-05T11:21:44.836869Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0429-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76\n  * GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c\n  * GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx\n\n- Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n\n- Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3428 CVE-2025-22867\n  * GO-2025-3447 CVE-2025-22866\n\n- Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3408\n  * GO-2025-3448 GHSA-23qp-3c2m-xx6w\n  * GO-2025-3449 GHSA-mx2j-7cmv-353c\n  * GO-2025-3450 GHSA-w7wm-2425-7p2h\n  * GO-2025-3454 GHSA-mj4v-hp69-27x5\n  * GO-2025-3455 GHSA-vqv5-385r-2hf8\n\n- Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3451\n\n- Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2\n  * GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v\n  * GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg\n  * GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c\n  * GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2\n  * GO-2025-3437 GHSA-274v-mgcv-cm8j\n  * GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58\n  * GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4\n  * GO-2025-3443 GHSA-r3r4-g7hq-pq4f\n  * GO-2025-3444 CVE-2024-35177\n  * GO-2025-3445 CVE-2024-47770\n\n- Use standard RPM macros to unpack the source and populate a\n  working directory. Fixes build with RPM 4.20.\n\n- Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3408\n  * GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n  * GO-2025-3424 CVE-2025-24369\n  * GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g\n  * GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56\n","status":"published","published":"2025-02-11T14:12:30Z","modified":"2026-02-05T00:10:56.097493Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0580-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to\n  overwrite other sensitive files in a system. (bsc#1236560)\n","status":"published","published":"2025-02-18T14:52:43Z","modified":"2026-02-04T04:21:37.979875Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0611-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to\n  overwrite other sensitive files in a system. (bsc#1236560)\n","status":"published","published":"2025-02-21T10:37:12Z","modified":"2026-02-04T04:05:43.866389Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0622-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana was updated from version 10.4.13 to 10.4.15:\n\n- Security issues fixed:\n    * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)\n    * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)\n    * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)\n    * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)\n- Other bugs fixed and changes:\n    * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key\n    * Added provisioning directories\n    * Use /bin/bash in wrapper scripts\n","status":"published","published":"2025-02-21T10:59:56Z","modified":"2026-02-04T03:44:56.470308Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0623-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana was updated from version 10.4.13 to 10.4.15:\n\n- Security issues fixed:\n    * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)\n    * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)\n    * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)\n    * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)\n- Other bugs fixed and changes:\n    * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key\n    * Added provisioning directories\n    * Use /bin/bash in wrapper scripts\n","status":"published","published":"2025-02-21T11:00:07Z","modified":"2026-02-04T03:08:54.321528Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0624-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana was updated from version 10.4.13 to 10.4.15:\n\n- Security issues fixed:\n    * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)\n    * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)\n    * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)\n    * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)\n- Other bugs fixed and changes:\n    * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key\n    * Added provisioning directories\n    * Use /bin/bash in wrapper scripts\n","status":"published","published":"2025-02-21T11:00:27Z","modified":"2026-02-04T03:59:59.883486Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20746-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\nUpdate to version 20250416.02 (bsc#1244304, bsc#1244503)\n\n  * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)\n  * Add output of some packagemanagers to the testdata (#808)\n\nFrom version 20250416.01:\n\n  * Refactor OS Info package (#809)\n\nFrom version 20250416.00:\n\n  * Report RPM inventory as YUM instead of empty SoftwarePackage\n    when neither Zypper nor YUM are installed. (#805)\n\nFrom version 20250414.00:\n\n  * Update hash computation algorithm (#799)\n\nUpdate to version 20250320.00:\n\n  * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)\n  * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)\n  * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)\n  * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)\n  * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)\n  * Add tests for retryutil package. (#795)\n  * Update OWNERS (#794)\n  * Use separate counters for pre- and post-patch reboots. (#788)\n  * Update owners (#789)\n  * Fix the vet errors for contants in logging (#786)\n  * change available package check (#783)\n  * Fix Inventory reporting e2e tests. (#782)\n  * fix e2e tests (#781)\n- Add -buildmode=pie to go build command line (bsc#1239948)\n","status":"published","published":"2025-09-12T09:02:40Z","modified":"2026-03-23T04:50:58.12208Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2026:22242-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues\n\n- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n  (bsc#1251453).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input (bsc#1251704).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n  header (bsc#1260264).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265762).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262926).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent \n  (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264923).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260615.01\n * Upgrade golang.org/x/crypto \u0026 golang.org/x/net (#1006)\n- from version 20260615.00\n * Add unit tests for ospatch_apt_upgrade.go (#938)\n- Update to version 20260611.00\n * Add unit tests for policies/policies.go PART 5 (#998)\n- from version 20260610.00\n * Add unit tests for policies/policies.go PART 4 (#997)\n- from version 20260609.02\n * squash commits (#936)\n- from version 20260609.01\n * Add unit tests for policies/policies.go PART 3 (#996)\n- from version 20260609.00\n * Add unit tests for policies/policies.go PART 2 (#991)\n- from version 20260602.01\n * Align format of dates and timestamp collected across Windows packages (#973)\n- from version 20260602.00\n * Add unit tests for config/config,go (#979)\n- from version 20260528.00\n * Bump github.com/containerd/containerd (#990)\n- from version 20260521.00\n * Cover agentconfig functionality by unit tests (#925)\n- from version 20260520.04\n * Add unit tests for policies/googet.go (#961)\n * Bump github.com/go-git/go-git/v5 (#987)\n- from version 20260520.02\n * Add unit tests for policies/yum.go (#952)\n * Add unit tests for policies/apt.go PART 3 (#951)\n- from version 20260520.00\n * Add unit tests for policies/zypper.go (#953)\n- from version 20260519.00\n * Add unit tests for policies/policies.go PART 1 (#949)\n- from version 20260513.01\n * Bump github.com/go-git/go-git/v5 (#981), this also updates\n golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)\n- from version 20260513.00\n * upgrade a few packages (#980)\n- from version 20260512.02\n * Add/improve unit tests for agentendpoint/exec_task.go (#933)\n- from version 20260512.01\n * Cover google_update.go by unit tests (#941)\n- from version 20260512.00\n * Change zone for arm64 builds because of stockout (#978)\n- Update to version 20260511.00\n * switch to t2a-standard-2 on ARM package build (#977)\n- from version 20260505.03\n * Cover zypper_patch by unit tests (#958)\n- from version 20260505.02\n * Remove unused functions DisableAutoUpdates (#970)\n- from version 20260505.01\n * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)\n- from version 20260505.00\n * Upgrade a few dependencies across the repo (#968)\n + github.com/go-git/go-git/v5 5.16.2-\u003e5.18.0 (bsc#1264923, CVE-2026-41506)\n + github.com/go-jose/go-jose/v4 4.1.3-\u003e4.1.4 (bsc#1262926, CVE-2026-34986)\n + github.com/go-viper/mapstructure/v2 2.3.0-\u003e2.4.0\n + go.opentelemetry.io/otel 1.40.0-\u003e1.41.0\n + go.opentelemetry.io/otel/sdk 1.39.0-\u003e1.43.0\n- from version 20260504.01\n * bump github.com/docker/cli to 29.2.0 (#962)\n- from version 20260504.00\n * Bump github.com/opencontainers/selinux (#960)\n- Update to version 20260428.00\n * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)\n- from version 20260427.03\n * Cover config/file.go by unit tests (#935)\n- from version 20260422.01\n * Cover patch_linux.go by unit tests (#932)\n- from version 20260422.00\n * upgrade grpc package in main package and e2e tests (#959)\n (bsc#1260264, CVE-2026-33186)\n- from version 20260417.04\n * Bump OSV-Scalibr version to v0.4.3 (#956)\n- from version 20260417.03\n * Add unit tests for updates_linux.go (#937)\n- from version 20260417.02\n * Add zone to CreateDisk step (#955)\n- from version 20260417.01\n * Change disk type for deb11 (#954)\n- from version 20260417.00\n * Add unit tests for policies/apt.go PART 1 (#950)\n- from version 20260410.02\n * Add unit tests for packages/pty_linux.go (#943)\n- from version 20260410.01\n * fix disk type for arm workflows (#948)\n- from version 20260410.00\n * Change machine type for arm based workflows (#946)\n- Update to version 20260330.00\n * bump timeouts for all workflows (#940)\n- from version 20260326.00\n * Cover exec_resource.go by unit tests (#934)\n- from version 20260318.00\n * Integrate OSConfig agent with ReportVmInventory (#923)\n- from version 20260313.02\n * remove cacheonly flag from yum upgrade (#924)\n- from version 20260313.01\n * conditions python version override (#927)\n- from version 20260313.00\n * Fix presubmits by explicitly set python version for rpm based systems (#926)\n- from version 20260311.00\n * Bump osconfig version (#922)\n- from version 20260309.02\n * Extend OSV scalibr extractor (#921)\n- from version 20260309.01\n * upgrade golang.org/x/crypto and it's transitive deps (#918)\n- from version 20260309.00\n * Add purl to pkg info (#920)\n- from version 20260306.00\n * Add 'Type' field to PkgInfo (#919)\n- from version 20260303.01\n * Upgrade go.opentelemetry.io/otel/sdk (#913)\n- from version 20260303.00\n * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)\n- from version 20260302.00\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)\n- from version 20260126.00\n * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)\n * Bump github.com/sirupsen/logrus (#894)\n- Update to version 20260119.00\n * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)\n- Update to version 20251230.00\n * chore: Migrate gsutil usage to gcloud storage (#904)\n- from version 20251223.00\n * fix e2e tests for report inventory (#903)\n- from version 20251222.01\n * Revert \"Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\" (#902)\n- from version 20251222.00\n * Bump golang to the new version (#900)\n- from version 20251218.00\n * add new CODEOWNERS (#901)\n- from version 20251217.00\n * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\n- Bump the golang compiler version to 1.24.5\n- Update to version 20251202.00\n * Revert \"Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\" (#893)\n- Update to version 20251201.00\n * Revert \"Bump github.com/containerd/containerd (#890)\" (#892)\n- Update to version 20251126.00\n * Bump github.com/containerd/containerd (#890)\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\n- Update to version 20251028.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)\n * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)\n- from version 20251023.02\n * Create multiple_os.yaml (#883)\n- from version 20251023.00\n * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)\n * Add test runner for e2e tests (#876)\n- Update to version 20250925.00\n * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)\n * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)\n * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)\n * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)\n- Update to version 20250902.01\n * Bump github.com/googleapis/enterprise-certificate-proxy (#829)\n- from version 20250902.00\n * update github.com/go-jose/go-jose/v4 (#869)\n * Upgrade scalibr and other deps (#866)\n- from version 20250901.00\n * Fix possibility of path traversal for zip and tar archival (#868)\n- from version 20250825.00\n * set CODEOWNERS file as required by org (#863)\n- from version 20250819.00\n * Fix/rhel10 build centos image (#860)\n- from version 20250814.00\n * Fix/rhel10 build image (#859)\n- from version 20250813.00\n * Fix: Add RHEL 10 support to RPM startup script (#858)\n- from version 20250811.00\n * Remove old/sles-15-sp4-sap as image is deprecated (#857)\n- Update to version 20250806.00\n * Fixed JSON identifier for the universe domain (#855)\n- from version 20250729.00\n * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)\n- from version 20250725.02\n * Update utils.go (#854)\n * Upgrade golang.org/x/oauth2 package to the latest. (#853)\n * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)\n- from version 20250725.01\n * Bump golang.org/x/oauth2 (#848)\n * Port fix for debian 11 to goo package manager. (#852)\n- from version 20250725.00\n * Update Golang version in common.sh and skip backports\n repo for debian 11 (#850)\n- from version 20250723.01\n * Add workflows to build package for el10 (#849)\n- from version 20250721.00\n * Make OS Config agent TPC aware (#846)\n- from version 20250718.00\n * Create workflows for new Debian 13. (#847)\n- Update to version 20250703.00\n * Fix sles images (#844)\n- from version 20250702.00\n * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)\n- from version 20250701.00\n * Bump the go_modules group across 1 directory with 2 updates (#840)\n- Update to version 20250606.00\n * Change base docker images Google's official base images. (#838)\n- Update to version 20250523.01\n * Add a simple no-op OS policy for user testing (#837)\n- from version 20250523.00\n * Introduce scalibr inventory extractor for dpkg/rpm/cos\n os/filesystem extractors (linux) (#834)\n * Trace GetInstalledPackages memory levels (#835)\n- from version 20250520.00\n- Update to version 20250513.00\n * Fix rpm extractor, handle (none) value correctly. (#833)\n- from version 20250512.01\n * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)\n- from version 20250512.00\n * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)\n- from version 20250508.01\n * cosmetic refactoring to osinfo package (#826)\n- from version 20250508.00\n * Refactor /inventory with dependency injection (#825)\n * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)\n * cover packages_linux.go file with tests (#824)\n * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)\n- from version 20250507.00\n * Add InstalledRPMPackages snapshot tests (#823)\n- from version 20250506.02\n * Yum tests: simplify initialization of exit errors (#820)\n- from version 20250506.01\n * Improve test coverage for gem package manager (#818)\n- from version 20250506.00\n * after go/x/crypto update 0.32.0 -\u003e 0.37.0 (#817)\n- from version 20250505.01\n * Improve packages package coverage (#814)\n * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)\n- from version 20250505.00\n * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)\n- from version 20250430.00\n * Snapshot YumUpdates (GetPackageUpdates) output (#813)\n- from version 20250428.00\n * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output\n for sles 12, 15 testdata (#812)\n- from version 20250423.00\n * Introduce MatchSnapshot large test results matcher function, snapshot\n apt-deb GetPackageUpdates (#811)\n- from version 20250416.02\n * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)\n * Add output of some packagemanagers to the testdata (#808)\n- from version 20250416.01\n * Refactor OS Info package (#809)\n- from version 20250416.00\n * Report RPM inventory as YUM instead of empty SoftwarePackage\n when neither Zypper nor YUM are installed. (#805)\n- from version 20250414.00\n * Update hash computation algorithm (#799)\n- Update to version 20250320.00\n * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)\n- from version 20250318.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)\n- from version 20250317.02\n * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)\n * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)\n- from version 20250317.01\n * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)\n- from version 20250317.00\n * Add tests for retryutil package. (#795)\n- from version 20250306.00\n * Update OWNERS (#794)\n- from version 20250206.01\n * Use separate counters for pre- and post-patch reboots. (#788)\n- from version 20250206.00\n * Update owners (#789)\n- from version 20250203.00\n * Fix the vet errors for contants in logging (#786)\n- from version 20250122.00\n * change available package check (#783)\n- from version 20250121.00\n * Fix Inventory reporting e2e tests. (#782)\n- from version 20250120.00\n * fix e2e tests (#781)\n- Add -buildmode=pie to go build command line (bsc#1239948)\n- from version 20240501.00 (bsc#1236533, CVE-2023-45288)\n","status":"published","published":"2026-06-22T09:09:04Z","modified":"2026-06-26T18:24:10.46168409Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}