When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02149-1 advisory.

    - Update to version 20250416.02 (bsc#1244304, bsc#1244503)
      * defaultSleeper: tolerate 10% difference to reduce test flakiness
      * Add output of some packagemanagers to the testdata
    - from version 20250416.01
      * Refactor OS Info package
    - from version 20250416.00
      * Report RPM inventory as YUM instead of empty SoftwarePackage         when neither Zypper nor YUM are installed.
    - from version 20250414.00
      * Update hash computation algorithm
    - Update to version 20250320.00
      * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1
    - from version 20250318.00
      * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0
    - from version 20250317.02
      * Bump cel.dev/expr from 0.18.0 to 0.22.0
      * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group
    - from version 20250317.01
      * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0
    - from version 20250317.00
      * Add tests for retryutil package.
    - from version 20250306.00
      * Update OWNERS
    - from version 20250206.01
      * Use separate counters for pre- and post-patch reboots.
    - from version 20250206.00
      * Update owners
    - from version 20250203.00
      * Fix the vet errors for contants in logging
    - from version 20250122.00
      * change available package check
    - from version 20250121.00
      * Fix Inventory reporting e2e tests.
    - from version 20250120.00
      * fix e2e tests
    - Add -buildmode=pie to go build command line (bsc#1239948)
    - merged upstream
    - Renumber patches

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02150-1 advisory.

    - Update to version 20250416.02 (bsc#1244304, bsc#1244503)
      * defaultSleeper: tolerate 10% difference to reduce test flakiness
      * Add output of some packagemanagers to the testdata
    - from version 20250416.01
      * Refactor OS Info package
    - from version 20250416.00
      * Report RPM inventory as YUM instead of empty SoftwarePackage         when neither Zypper nor YUM are installed.
    - from version 20250414.00
      * Update hash computation algorithm
    - Update to version 20250320.00
      * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1
    - from version 20250318.00
      * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0
    - from version 20250317.02
      * Bump cel.dev/expr from 0.18.0 to 0.22.0
      * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group
    - from version 20250317.01
      * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0
    - from version 20250317.00
      * Add tests for retryutil package.
    - from version 20250306.00
      * Update OWNERS
    - from version 20250206.01
      * Use separate counters for pre- and post-patch reboots.
    - from version 20250206.00
      * Update owners
    - from version 20250203.00
      * Fix the vet errors for contants in logging
    - from version 20250122.00
      * change available package check
    - from version 20250121.00
      * Fix Inventory reporting e2e tests.
    - from version 20250120.00
      * fix e2e tests
    - Add -buildmode=pie to go build command line (bsc#1239948)
    - merged upstream
    - Renumber patches

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01985-1 advisory.

    release-notes-susemanager:

    - Update to SUSE Manager 4.3.15.2
      * SUSE Manager 4.3 will transition to LTS after June 2025
      * CVE Fixed         CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339         CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870         CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454         CVE-2025-3580, CVE-2025-4123, CVE-2024-47535

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4518c12e2f advisory.

    Update to version 2.10.0. Aside from the new upstream features, this update also refreshes many bundled     dependencies, fixing a few CVEs.

    https://github.com/caddyserver/caddy/releases/tag/v2.10.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-89401f2116 advisory.

    Update to version 2.10.0.  Aside from the new upstream features, this update also refreshes many bundled     dependencies, fixing a few CVEs.

    https://github.com/caddyserver/caddy/releases/tag/v2.10.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a     privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When     that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix     that, glog now causes the program to exit (with status code 2) when it finds that the configured log file     already exists. (CVE-2024-45339)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0611-1 advisory.

    - CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and     used to       overwrite other sensitive files in a system. (bsc#1236560)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0623-1 advisory.

    grafana was updated from version 10.4.13 to 10.4.15:

    - Security issues fixed:
        * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
        * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
        * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
        * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
    - Other bugs fixed and changes:
        * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
        * Added provisioning directories
        * Use /bin/bash in wrapper scripts

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:0580-1 advisory.

    - CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and     used to       overwrite other sensitive files in a system. (bsc#1236560)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4056 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4056-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     February 17, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : golang-glog     Version        : 0.0~git20160126.23def4e-3+deb11u1     CVE ID         : CVE-2024-45339

    The following vulnerability has been discovered in the glog package for Go:

    When logs are written to a widely-writable directory (the default), an     unprivileged attacker may predict a privileged process's log file path     and pre-create a symbolic link to a sensitive file in its place. When     that privileged process runs, it will follow the planted symlink and     overwrite that sensitive file. To fix that, glog now causes the program     to exit (with status code 2) when it finds that the configured log file     already exists.

    For Debian 11 bullseye, this problem has been fixed in version     0.0~git20160126.23def4e-3+deb11u1.


    The following Go packages have been rebuilt in order to fix this     issue:

    docker.io 20.10.5+dfsg1-1+deb11u4     golang-grpc-gateway 1.6.4-2+deb11u1     mtail 3.0.0~rc43-3+deb11u1     prometheus-mongodb-exporter 1.0.0+git20180522.e755a44-3+deb11u1

    We recommend that you upgrade these packages.

    For the detailed security status of golang-glog please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/golang-glog

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sriov-network-device-plugin / vitess installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45339 advisory.

  - When logs are written to a widely-writable directory (the default), an unprivileged attacker May predict a     privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When     that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix     that, glog now causes the program to exit (with status code 2) when it finds that the configured log file     already exists. (CVE-2024-45339)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sriov-network-device-plugin / vitess installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45339 advisory.

  - When logs are written to a widely-writable directory (the default), an unprivileged attacker May predict a     privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When     that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix     that, glog now causes the program to exit (with status code 2) when it finds that the configured log file     already exists. (CVE-2024-45339)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0429-1 advisory.

    - Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76
      * GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c
      * GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx

    - Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74
      * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g

    - Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3428 CVE-2025-22867
      * GO-2025-3447 CVE-2025-22866

    - Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3408
      * GO-2025-3448 GHSA-23qp-3c2m-xx6w
      * GO-2025-3449 GHSA-mx2j-7cmv-353c
      * GO-2025-3450 GHSA-w7wm-2425-7p2h
      * GO-2025-3454 GHSA-mj4v-hp69-27x5
      * GO-2025-3455 GHSA-vqv5-385r-2hf8

    - Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3451

    - Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2
      * GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v
      * GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg
      * GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c
      * GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2
      * GO-2025-3437 GHSA-274v-mgcv-cm8j
      * GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58
      * GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4
      * GO-2025-3443 GHSA-r3r4-g7hq-pq4f
      * GO-2025-3444 CVE-2024-35177
      * GO-2025-3445 CVE-2024-47770

    - Use standard RPM macros to unpack the source and populate a       working directory. Fixes build with RPM 4.20.

    - Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425
      * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
      * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
      * GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf
      * GO-2025-3373 CVE-2024-45341
      * GO-2025-3383 CVE-2024-45340
      * GO-2025-3408
      * GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9
      * GO-2025-3420 CVE-2024-45336
      * GO-2025-3421 CVE-2025-22865
      * GO-2025-3424 CVE-2025-24369
      * GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g
      * GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0297-1 advisory.

    - Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
      * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
      * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
      * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
      * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
      * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
      * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
      * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
      * GO-2025-3422 CVE-2025-24354

    - Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3372 CVE-2024-45339
      * GO-2025-3373 CVE-2024-45341
      * GO-2025-3383 CVE-2024-45340
      * GO-2025-3420 CVE-2024-45336
      * GO-2025-3421 CVE-2025-22865

    - Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
      * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
      * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
      * GO-2025-3396 CVE-2024-52594
      * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
      * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
      * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
      * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
      * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
      * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

    - Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
      * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
      * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
      * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
      * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

    - Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.
      Refs jsc#PED-11136       Go CVE Numbering Authority IDs added or updated with aliases:
      * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
      * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
      * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
      * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240905	SUSE SLES15 / openSUSE 15 Security Update : google-osconfig-agent (SUSE-SU-2025:02149-1)	Nessus	SuSE Local Security Checks	high
240899	SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2025:02150-1)	Nessus	SuSE Local Security Checks	high
240808	SUSE SLES15 : Security update 4.3.15 for Multi-Linux Manager Server (SUSE-SU-2025:01985-1)	Nessus	SuSE Local Security Checks	critical
238233	Fedora 42 : caddy (2025-4518c12e2f)	Nessus	Fedora Local Security Checks	medium
238232	Fedora 43 : caddy (2025-89401f2116)	Nessus	Fedora Local Security Checks	medium
228904	Linux Distros Unpatched Vulnerability : CVE-2024-45339	Nessus	Misc.	high
216659	SUSE SLES15 / openSUSE 15 Security Update : google-osconfig-agent (SUSE-SU-2025:0611-1)	Nessus	SuSE Local Security Checks	high
216639	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:0623-1)	Nessus	SuSE Local Security Checks	critical
216441	SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2025:0580-1)	Nessus	SuSE Local Security Checks	high
216383	Debian dla-4056 : golang-glog-dev - security update	Nessus	Debian Local Security Checks	high
216285	CBL Mariner 2.0 Security Update: sriov-network-device-plugin / vitess (CVE-2024-45339)	Nessus	MarinerOS Local Security Checks	high
216278	Azure Linux 3.0 Security Update: sriov-network-device-plugin / vitess (CVE-2024-45339)	Nessus	Azure Linux Local Security Checks	high
216199	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0429-1)	Nessus	SuSE Local Security Checks	high
214906	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0297-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-45339

high

Tenable Plugins

high

high

critical

medium

medium

high

high

critical

high

high

high

high

high

high