id: GO-2025-3372
modules:
    - module: github.com/golang/glog
      versions:
        - fixed: 1.2.4
      vulnerable_at: 1.2.3
      packages:
        - package: github.com/golang/glog
          symbols:
            - create
          derived_symbols:
            - Error
            - ErrorContext
            - ErrorContextDepth
            - ErrorContextDepthf
            - ErrorContextf
            - ErrorDepth
            - ErrorDepthf
            - Errorf
            - Errorln
            - Exit
            - ExitContext
            - ExitContextDepth
            - ExitContextDepthf
            - ExitContextf
            - ExitDepth
            - ExitDepthf
            - Exitf
            - Exitln
            - Fatal
            - FatalContext
            - FatalContextDepth
            - FatalContextDepthf
            - FatalContextf
            - FatalDepth
            - FatalDepthf
            - Fatalf
            - Fatalln
            - Info
            - InfoContext
            - InfoContextDepth
            - InfoContextDepthf
            - InfoContextf
            - InfoDepth
            - InfoDepthf
            - Infof
            - Infoln
            - Verbose.Info
            - Verbose.InfoContext
            - Verbose.InfoContextDepth
            - Verbose.InfoContextDepthf
            - Verbose.InfoContextf
            - Verbose.InfoDepth
            - Verbose.InfoDepthf
            - Verbose.Infof
            - Verbose.Infoln
            - Warning
            - WarningContext
            - WarningContextDepth
            - WarningContextDepthf
            - WarningContextf
            - WarningDepth
            - WarningDepthf
            - Warningf
            - Warningln
            - fileSink.Emit
            - logBridge.Write
            - syncBuffer.Write
summary: Vulnerability when creating log files in github.com/golang/glog
description: |-
    When logs are written to a widely-writable directory (the default), an
    unprivileged attacker may predict a privileged process's log file path and
    pre-create a symbolic link to a sensitive file in its place. When that
    privileged process runs, it will follow the planted symlink and overwrite that
    sensitive file. To fix that, glog now causes the program to exit (with status
    code 2) when it finds that the configured log file already exists.
ghsas:
    - GHSA-6wxm-mpqj-6jpf
credits:
    - Josh McSavaney
    - Günther Noack
references:
    - fix: https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
    - fix: https://github.com/golang/glog/pull/74
    - web: https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
    - web: https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
cve_metadata:
    id: CVE-2024-45339
    cwe: 'CWE-61: UNIX Symbolic Link (Symlink) Following'
source:
    id: go-security-team
    created: 2025-01-27T16:00:03.131884-05:00
review_status: REVIEWED