Vulnerability when creating log files in github.com/golang/glog (github.com/golang/glog github.com/golang/glog)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.32 % · percentile 25 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Go
- NVD status
- Deferred
Description
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
References
- https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2
- https://github.com/golang/glog/pull/74
- https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs
- https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File
- https://pkg.go.dev/vuln/GO-2025-3372
- https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-6wxm-mpqj-6jpf — Insecure Temporary File usage in github.com/golang/glog
- GO-2025-3372 — Vulnerability when creating log files in github.com/golang/glog
European references
- ENISA EUVD · EUVD-2025-0139
- GCVE · GCVE-0-2024-45339
CERT-FR advisories
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0671 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| github.com/golang/glog · github.com/golang/glog | affected 0 < 1.2.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |