x/vulndb: potential Go vuln in github.com/golang/glog: GHSA-6wxm-mpqj-6jpf

[GoVulnBot]

Advisory GHSA-6wxm-mpqj-6jpf references a vulnerability in the following Go modules:

Module
github.com/golang/glog

Description:
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

References:

• ADVISORY: GHSA-6wxm-mpqj-6jpf
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-45339
• FIX: Fail if log file already exists glog#74
• FIX: golang/glog@b874165
• WEB: https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
• WEB: https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File

!! Possible duplicate report !!

• CVE-2024-45339 appears in 1 other report(s):
  • data/reports/GO-2025-3372.yaml (x/vulndb: potential Go vuln in github.com/golang/glog: CVE-2024-45339 #3372)

Cross references:

• github.com/golang/glog appears in 1 other report(s):
  • data/reports/GO-2025-3372.yaml (x/vulndb: potential Go vuln in github.com/golang/glog: CVE-2024-45339 #3372)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/golang/glog
      versions:
        - fixed: 1.2.4
      vulnerable_at: 1.2.3
summary: Insecure Temporary File usage in github.com/golang/glog
cves:
    - CVE-2024-45339
ghsas:
    - GHSA-6wxm-mpqj-6jpf
references:
    - advisory: https://github.com/advisories/GHSA-6wxm-mpqj-6jpf
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45339
    - fix: https://github.com/golang/glog/pull/74
    - fix: https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
    - web: https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
    - web: https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
source:
    id: GHSA-6wxm-mpqj-6jpf
    created: 2025-01-28T18:01:23.939697636Z
review_status: UNREVIEWED

[tatianab]

Duplicate of #3372

[gopherbot]

Change https://go.dev/cl/645139 mentions this issue: data/reports: update GO-2025-3372 (add GHSA)