GO-2025-3372

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2025-3372

Import Source

https://vuln.go.dev/ID/GO-2025-3372.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2025-3372

Aliases

Published

2025-01-28T00:47:30Z

Modified

2025-01-29T00:01:36Z

Summary

Vulnerability when creating log files in github.com/golang/glog

Details

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-3372"
}

References

Credits

- Josh McSavaney
- Günther Noack

Affected packages

Go / github.com/golang/glog

Package

Name: github.com/golang/glog; View open source insights on deps.dev
Purl: pkg:golang/github.com/golang/glog

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.4

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/golang/glog",
            "symbols": [
                "Error",
                "ErrorContext",
                "ErrorContextDepth",
                "ErrorContextDepthf",
                "ErrorContextf",
                "ErrorDepth",
                "ErrorDepthf",
                "Errorf",
                "Errorln",
                "Exit",
                "ExitContext",
                "ExitContextDepth",
                "ExitContextDepthf",
                "ExitContextf",
                "ExitDepth",
                "ExitDepthf",
                "Exitf",
                "Exitln",
                "Fatal",
                "FatalContext",
                "FatalContextDepth",
                "FatalContextDepthf",
                "FatalContextf",
                "FatalDepth",
                "FatalDepthf",
                "Fatalf",
                "Fatalln",
                "Info",
                "InfoContext",
                "InfoContextDepth",
                "InfoContextDepthf",
                "InfoContextf",
                "InfoDepth",
                "InfoDepthf",
                "Infof",
                "Infoln",
                "Verbose.Info",
                "Verbose.InfoContext",
                "Verbose.InfoContextDepth",
                "Verbose.InfoContextDepthf",
                "Verbose.InfoContextf",
                "Verbose.InfoDepth",
                "Verbose.InfoDepthf",
                "Verbose.Infof",
                "Verbose.Infoln",
                "Warning",
                "WarningContext",
                "WarningContextDepth",
                "WarningContextDepthf",
                "WarningContextf",
                "WarningDepth",
                "WarningDepthf",
                "Warningf",
                "Warningln",
                "create",
                "fileSink.Emit",
                "logBridge.Write",
                "syncBuffer.Write"
            ]
        }
    ]
}