Update module github.com/golang/glog to v1.2.4 [SECURITY]

Sebastian Kawelkerequested to merge
renovate/go-github.com-golang-glog-vulnerability into main

This MR contains the following updates:

Package Change Age Confidence
github.com/golang/glog v1.2.2 -> v1.2.4 age confidence

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Insecure Temporary File usage in github.com/golang/glog

CVE-2024-45339 / GHSA-6wxm-mpqj-6jpf / GO-2025-3372

More information

Details

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Severity

  • CVSS Score: 4.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/MR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Vulnerability when creating log files in github.com/golang/glog

CVE-2024-45339 / GHSA-6wxm-mpqj-6jpf / GO-2025-3372

More information

Details

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

❗ Important

Release Notes retrieval for this MR were skipped because no github.com credentials were available. If you are self-hosted, please see this instruction.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports