Link following in glog - CVE-2024-45339

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU104138

Link following in glog - CVE-2024-45339

Published: February 21, 2025


Vulnerability identifier: #VU104138
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45339
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to overwrite arbitrary files on the system.

The vulnerability exists due to insecure link following when writing log files. A local user can point a symbolic link to a critical file on the system and overwrite it with the log data.


Affected software

glog
Db2 Intelligence Center
Financial Transaction Manager for RedHat OpenShift
Storage Protect Server
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE
Public Cloud Module
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Package Hub 15
openSUSE Leap
Fedora
Netcool Operations Insight
IBM Fusion HCI
Red Hat OpenShift Container Platform
Communications Unified Assurance
caddy
grafana
grafana-debuginfo
google-osconfig-agent

How to mitigate CVE-2024-45339

Install updates from vendor's website.

glog - update to 1.2.4
Db2 Intelligence Center - update to 1.1.1.0
Netcool Operations Insight - update to 1.6.15
IBM Fusion HCI - update to 2.10.0
Red Hat OpenShift Container Platform - addressed in versions 4.12.79, 4.14.55, 4.15.56, 4.16.45, 4.16.46, 4.17.37, 4.17.45, 4.18.21, 4.18.22, 4.19.6, 4.19.7
caddy - addressed in versions 2.10.0-1.fc42, 2.10.0-1.fc43
Storage Protect Server - update to 8.1.27.100
grafana - addressed in versions 10.4.15-1.71.1, 10.4.15-150000.1.71.1, 10.4.15-150200.3.64.1
grafana-debuginfo - addressed in versions 10.4.15-150000.1.71.1, 10.4.15-150200.3.64.1
google-osconfig-agent - addressed in versions 20250115.01-1.35.1, 20250115.01-150000.1.44.1

External References

Related Security Bulletins