Vulnerability when creating log files in github.com/golang/glog
Priority LOW 33CWE-377Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 12 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix Partial github.com/golang/glog (github.com/golang/glog): 1.2.4github.com/golang/glog (Go): 1.2.4Red Hat: 46 advisoriesRed Hat: 12 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| github.com/golang/glog | github.com/golang/glog | before 1.2.4 | 1.2.4 | Patch available | CNA |
| — | github.com/golang/glog (Go) | before 1.2.4 | 1.2.4 | Patch available | GHSA-6wxm-mpqj-6jpf |
- github.com/golang/glog Vendorgithub.com/golang/glog Affected before 1.2.4 Fixed in 1.2.4 Patch available CNA
- github.com/golang/glog (Go) Vendor— Affected before 1.2.4 Fixed in 1.2.4 Patch available GHSA-6wxm-mpqj-6jpf
Remediation
- Fix · CNA github.com/golang/glog (github.com/golang/glog) Fixed in 1.2.4
- Fix · GHSA-6wxm-mpqj-6jpf github.com/golang/glog (Go) Fixed in 1.2.4 Advisory →
Red Hat 46 advisories
- RHSA-2025:22863 Released 2025-12-08 · Red Hat rating ImportantOpenShift Container Platform 4.17.45 CNF IBU extras update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
- RHSA-2025:19357 Released 2025-10-30 · Red Hat rating ImportantOpenShift Container Platform 4.16.51 CNF IBU extras update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
- RHSA-2025:19356 Released 2025-10-30 · Red Hat rating ImportantOpenShift Container Platform 4.14.57 CNF IBU extras update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
Show 43 more Red Hat advisories
- RHSA-2025:9562 Released 2025-10-21 · Red Hat rating ImportantOpenShift Container Platform 4.20.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +8
- RHSA-2025:9563 Released 2025-10-21 · Red Hat rating ImportantOpenShift Container Platform 4.20.0 security and extras update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/metallb-rhel9-operator, registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9
- RHSA-2025:17672 Released 2025-10-16 · Red Hat rating ImportantOpenShift Container Platform 4.12.81 security and extras update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/metallb-rhel8-operator, registry.redhat.io/openshift4/ose-operator-sdk-rhel8
- RHSA-2025:17671 Released 2025-10-16 · Red Hat rating ImportantOpenShift Container Platform 4.12.81 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-coredns, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel8, registry.redhat.io/openshift4/ose-nutanix-machine-controllers-rhel8 +1
- RHSA-2025:16160 Released 2025-09-25 · Red Hat rating ImportantOpenShift Container Platform 4.15.58 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9
- RHSA-2025:16161 Released 2025-09-25 · Red Hat rating ImportantOpenShift Container Platform 4.15.58 security and extras update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/metallb-rhel9-operator, registry.redhat.io/openshift4/ose-operator-sdk-rhel8
- RHSA-2025:16534 Released 2025-09-23 · Red Hat rating ImportantOpenShift Container Platform 4.12 ztp-site-generate container
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ztp-site-generate-rhel8
- RHSA-2025:16530 Released 2025-09-23 · Red Hat rating ImportantOpenShift Container Platform 4.18 ztp-site-generate container
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ztp-site-generate-rhel8
- RHSA-2025:16529 Released 2025-09-23 · Red Hat rating ImportantOpenShift Container Platform 4.17 ztp-site-generate container
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ztp-site-generate-rhel8
- RHSA-2025:16527 Released 2025-09-23 · Red Hat rating ImportantOpenShift Container Platform 4.16 ztp-site-generate container
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ztp-site-generate-rhel8
- RHSA-2025:16526 Released 2025-09-23 · Red Hat rating ImportantOpenShift Container Platform 4.14 ztp-site-generate container
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ztp-site-generate-rhel8
- RHSA-2025:15673 Released 2025-09-18 · Red Hat rating ImportantOpenShift Container Platform 4.13.60 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8 +8
- RHSA-2025:15674 Released 2025-09-18 · Red Hat rating ImportantOpenShift Container Platform 4.13.60 security and extras update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/metallb-rhel8, registry.redhat.io/openshift4/metallb-rhel8-operator, registry.redhat.io/openshift4/ose-ptp +4
- RHSA-2025:15332 Released 2025-09-11 · Red Hat rating ImportantOpenShift Container Platform 4.12.80 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8 +6
- RHSA-2025:15333 Released 2025-09-11 · Red Hat rating ImportantOpenShift Container Platform 4.12.80 security and extras update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/metallb-rhel8, registry.redhat.io/openshift4/metallb-rhel8-operator, registry.redhat.io/openshift4/ose-ptp +4
- RHSA-2025:14820 Released 2025-09-04 · Red Hat rating ImportantOpenShift Container Platform 4.18.23 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9
- RHSA-2025:14859 Released 2025-09-04 · Red Hat rating ImportantOpenShift Container Platform 4.16.47 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-multus-admission-controller-rhel9, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9
- RHSA-2025:14855 Released 2025-09-04 · Red Hat rating ImportantOpenShift Container Platform 4.14.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-cluster-image-registry-operator, registry.redhat.io/openshift4/ose-coredns, registry.redhat.io/openshift4/ose-multus-admission-controller +1
- RHSA-2025:14856 Released 2025-09-04 · Red Hat rating ImportantOpenShift Container Platform 4.14.56 security and extras update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ingress-node-firewall-rhel9, registry.redhat.io/openshift4/metallb-rhel9-operator, registry.redhat.io/openshift4/ose-sriov-dp-admission-controller +2
- RHSA-2025:14821 Released 2025-09-03 · Red Hat rating ImportantOpenShift Container Platform 4.18.23 security and extras update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/metallb-rhel9-operator, registry.redhat.io/openshift4/ose-operator-sdk-rhel9
- RHSA-2025:14860 Released 2025-09-03 · Red Hat rating ImportantOpenShift Container Platform 4.16.47 security and extras update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/metallb-rhel9-operator
- RHSA-2025:14397 Released 2025-08-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +2
- RHSA-2025:14060 Released 2025-08-27 · Red Hat rating ImportantOpenShift Container Platform 4.17.38 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9 +2
- RHSA-2025:14398 Released 2025-08-27 · Red Hat rating ImportantOpenShift Container Platform 4.15.57 security and extras update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ingress-node-firewall-rhel9, registry.redhat.io/openshift4/ose-ptp-rhel9, registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9 +2
- RHSA-2025:14061 Released 2025-08-27 · Red Hat rating ImportantOpenShift Container Platform 4.17.38 security and extras update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/metallb-rhel9-operator, registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9
- RHSA-2025:13848 Released 2025-08-19 · Red Hat rating ImportantOpenShift Container Platform 4.19.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9
- RHSA-2025:13849 Released 2025-08-19 · Red Hat rating ImportantOpenShift Container Platform 4.19.9 security and extras update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/metallb-rhel9-operator
- RHSA-2025:13289 Released 2025-08-14 · Red Hat rating ImportantOpenShift Container Platform 4.14.55 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-agent-installer-csr-approver-rhel8, openshift4/ose-agent-installer-node-agent-rhel9 +4
- RHSA-2025:13291 Released 2025-08-14 · Red Hat rating ImportantOpenShift Container Platform 4.14.55 security and extras update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-event-proxy-rhel8, openshift4/ose-cloud-event-proxy-rhel8, openshift4/ose-ptp-operator +1
- RHSA-2025:13338 Released 2025-08-13 · Red Hat rating ImportantOpenShift Container Platform 4.16.46 security and extras update
- Red Hat OpenShift Container Platform 4.16 openshift4/ingress-node-firewall-rhel9, openshift4/ose-cloud-event-proxy-rhel9, openshift4/ose-ptp-rhel9 +4
- RHSA-2025:13327 Released 2025-08-13 · Red Hat rating ImportantOpenShift Container Platform 4.18.22 security and extras update
- Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ose-sriov-network-device-plugin-rhel9
- RHSA-2025:12325 Released 2025-08-07 · Red Hat rating ImportantOpenShift Container Platform 4.12.79 security and extras update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-event-proxy-rhel8, openshift4/ose-cloud-event-proxy, openshift4/ose-cloud-event-proxy-rhel8 +1
- RHSA-2025:12372 Released 2025-08-06 · Red Hat rating ImportantOpenShift Container Platform 4.15.56 security and extras update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-cloud-event-proxy-rhel9, openshift4/ose-ptp-rhel9-operator
- RHSA-2025:12439 Released 2025-08-06 · Red Hat rating ImportantOpenShift Container Platform 4.17.37 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/ingress-node-firewall-rhel9-operator, openshift4/ose-cloud-event-proxy-rhel9, openshift4/ose-ptp-rhel9-operator +2
- RHSA-2025:11677 Released 2025-07-30 · Red Hat rating ImportantOpenShift Container Platform 4.18.21 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/ose-agent-installer-csr-approver-rhel9, openshift4/ose-aws-cluster-api-controllers-rhel9, openshift4/ose-ibm-vpc-block-csi-driver-rhel9 +1
- RHSA-2025:11679 Released 2025-07-30 · Red Hat rating ImportantOpenShift Container Platform 4.18.21 security and extras update
- Red Hat OpenShift Container Platform 4.18 openshift4/ose-ptp-rhel9, openshift4/ose-ptp-rhel9-operator, openshift4/ose-sriov-dp-admission-controller-rhel9 +1
- RHSA-2025:11681 Released 2025-07-30 · Red Hat rating ImportantOpenShift Container Platform 4.16.45 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2025:11673 Released 2025-07-29 · Red Hat rating ImportantOpenShift Container Platform 4.19.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 openshift4/ose-aws-cluster-api-controllers-rhel9, rhcos
- RHSA-2025:11675 Released 2025-07-29 · Red Hat rating ImportantOpenShift Container Platform 4.19.6 security and extras update
- Red Hat OpenShift Container Platform 4.19 openshift4/ose-sriov-dp-admission-controller-rhel9, openshift4/ose-sriov-network-device-plugin-rhel9
- RHSA-2025:3397 Released 2025-03-31 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:3368 Released 2025-03-27 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:2223 Released 2025-03-04 · Red Hat rating ImportantRed Hat Product OCP Tools 4.12 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1740464689-1.el8, jenkins-2.479.3.1740464431-3.el8
- RHSA-2025:1448 Released 2025-02-13 · Red Hat rating ImportantRHOAI 2.17.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.17 registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8 +5
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Cluster Manager CLI | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2025:2223 |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2025:3368 |
| Red Hat OpenShift AI 2.17 | Fixed | RHSA-2025:1448 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2025:12325, RHSA-2025:15332, RHSA-2025:15333, RHSA-2025:16534, RHSA-2025:17671, RHSA-2025:17672 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2025:15673, RHSA-2025:15674 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2025:13289, RHSA-2025:13291, RHSA-2025:14855, RHSA-2025:14856, RHSA-2025:16526, RHSA-2025:19356 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2025:12370, RHSA-2025:12372, RHSA-2025:14397, RHSA-2025:14398, RHSA-2025:16160, RHSA-2025:16161 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2025:11681, RHSA-2025:13336, RHSA-2025:13338, RHSA-2025:14859, RHSA-2025:14860, RHSA-2025:16527, RHSA-2025:19357 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2025:12437, RHSA-2025:12439, RHSA-2025:14060, RHSA-2025:14061, RHSA-2025:16529, RHSA-2025:22863 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2025:11677, RHSA-2025:11679, RHSA-2025:13325, RHSA-2025:13327, RHSA-2025:14820, RHSA-2025:14821, RHSA-2025:16530 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2025:11673, RHSA-2025:11675, RHSA-2025:12341, RHSA-2025:13848, RHSA-2025:13849 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2025:9562, RHSA-2025:9563 |
Not affected: 14 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 2.17
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat Trusted Artifact Signer
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45339
- 2026-10-03 Alias added: GHSA-6wxm-mpqj-6jpf
References
Other 7
- https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
- https://github.com/golang/glog/pull/74
- https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
- https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
- https://pkg.go.dev/vuln/GO-2025-3372
- https://github.com/golang/glog
- https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html
Sources
- CVE-2024-45339 · CVE Program
- CVE-2024-45339 · NVD
- FIRST EPSS
- GHSA-6wxm-mpqj-6jpf · GitHub Advisory Database · CC BY 4.0
- CVE-2024-45339 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences