Linux-pam: linux-pam directory traversal
Priority LOW 36CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed linux-pam: 1.7.1Red Hat: 26 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | linux-pam | before 1.7.1 | 1.7.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 1.6.1-8.el10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 1.6.1-8.el10_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 1.1.8-23.el7_9.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.3.1-37.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.3.1-38.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 1.3.1-8.el8_2.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 1.3.1-14.el8_4.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 1.3.1-16.el8_6.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 1.3.1-16.el8_6.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 1.3.1-16.el8_6.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 1.3.1-26.el8_8.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 1.3.1-26.el8_8.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.5.1-26.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.5.1-25.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.5.1-26.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.5.1-25.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 1.5.1-9.el9_0.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 1.5.1-15.el9_2.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 1.5.1-24.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — | 1.11-19 | Patch available | CNA |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — | 1.11-8 | Patch available | CNA |
| Red Hat | Red Hat Web Terminal 1.12 on RHEL 9 | — | 1.12-4 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-4.1752066672 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-4.1752065732 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-4.1752065732 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-3.1752065737 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-4.1752065731 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-25 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-4.1752065736 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-2.1752065733 | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.13.5-4.1752065755 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-11 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-11 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-11 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-10 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-10 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-4 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-9 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-12 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-18 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-11 | Patch available | CNA |
| Red Hat | RHOSS-1.36-RHEL-8 | — | 1.36.0-7 | Patch available | CNA |
| Red Hat | cert-manager operator for Red Hat OpenShift 1.16 | — | v1.16.5-1760515757 | Patch available | CNA |
| Red Hat | OpenShift Compliance Operator 1 | — | 1.8.0 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 2.0.0-1752592913 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | 2.2.1-1758555934 | Patch available | CNA |
| Red Hat | Red Hat Insights proxy 1.5 | — | 1.5.7-1759331989 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752046452 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752046437 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752046439 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752070865 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752070873 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1751993590 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752070827 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752070833 | Patch available | CNA |
| Red Hat | Red Hat OpenShift distributed tracing 3.6.0 | — | rhosdt-3.6-1752070866 | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.10 | — | 1.10.2-1757422110 | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.10 | — | 1.10.2-1757421804 | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.10 | — | 1.10.2-1757421879 | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.10 | — | 1.10.2-1757422401 | Patch available | CNA |
- linux-pam Vendor— Affected before 1.7.1 Fixed in 1.7.1 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.6.1-8.el10 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.6.1-8.el10_0 Patch available CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.1.8-23.el7_9.1 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.3.1-37.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.3.1-38.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1.3.1-8.el8_2.1 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.3.1-14.el8_4.1 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.3.1-16.el8_6.2 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.3.1-16.el8_6.2 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.3.1-16.el8_6.2 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.3.1-26.el8_8.1 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.3.1-26.el8_8.1 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.1-26.el9_6 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.1-25.el9_6 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.1-26.el9_6 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.1-25.el9_6 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.5.1-9.el9_0.2 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.5.1-15.el9_2.1 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 1.5.1-24.el9_4 Patch available CNA
- Red Hat Web Terminal 1.11 on RHEL 9 VendorRed Hat Affected — Fixed in 1.11-19 Patch available CNA
- Red Hat Web Terminal 1.11 on RHEL 9 VendorRed Hat Affected — Fixed in 1.11-8 Patch available CNA
- Red Hat Web Terminal 1.12 on RHEL 9 VendorRed Hat Affected — Fixed in 1.12-4 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-4.1752066672 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-4.1752065732 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-4.1752065732 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-3.1752065737 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-4.1752065731 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-25 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-4.1752065736 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-2.1752065733 Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.13.5-4.1752065755 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-11 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-11 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-11 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-10 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-10 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-4 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-9 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-12 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-18 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-11 Patch available CNA
- RHOSS-1.36-RHEL-8 VendorRed Hat Affected — Fixed in 1.36.0-7 Patch available CNA
- cert-manager operator for Red Hat OpenShift 1.16 VendorRed Hat Affected — Fixed in v1.16.5-1760515757 Patch available CNA
- OpenShift Compliance Operator 1 VendorRed Hat Affected — Fixed in 1.8.0 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 2.0.0-1752592913 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in 2.2.1-1758555934 Patch available CNA
- Red Hat Insights proxy 1.5 VendorRed Hat Affected — Fixed in 1.5.7-1759331989 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752046452 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752046437 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752046439 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752070865 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752070873 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1751993590 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752070827 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752070833 Patch available CNA
- Red Hat OpenShift distributed tracing 3.6.0 VendorRed Hat Affected — Fixed in rhosdt-3.6-1752070866 Patch available CNA
- Red Hat OpenShift sandboxed containers 1.10 VendorRed Hat Affected — Fixed in 1.10.2-1757422110 Patch available CNA
- Red Hat OpenShift sandboxed containers 1.10 VendorRed Hat Affected — Fixed in 1.10.2-1757421804 Patch available CNA
- Red Hat OpenShift sandboxed containers 1.10 VendorRed Hat Affected — Fixed in 1.10.2-1757421879 Patch available CNA
- Red Hat OpenShift sandboxed containers 1.10 VendorRed Hat Affected — Fixed in 1.10.2-1757422401 Patch available CNA
CPE names CNA · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:enterprise_linux:10.1 | 10.1 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux_eus:10.0 | 10.0 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:8::baseos | 8 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.2::baseos | 8.2 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.4::baseos | 8.4 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_tus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.8::baseos | 8.8 | — | Red Hat |
- cpe:/o:redhat:enterprise_linux:10.1 Versions 10.1 — ·Red Hat
- cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.2::baseos Versions 8.2 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.4::baseos Versions 8.4 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_tus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.8::baseos Versions 8.8 — ·Red Hat
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:rhel_tus:8.8::baseos | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:9::baseos | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.0::baseos | 9.0 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.2::baseos | 9.2 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.4::appstream | 9.4 | — | Red Hat |
| cpe:/o:redhat:rhel_eus:9.4::baseos | 9.4 | — | Red Hat |
| cpe:/a:redhat:webterminal:1.11::el9 | 1.11 | — | Red Hat |
| cpe:/a:redhat:webterminal:1.12::el9 | 1.12 | — | Red Hat |
| cpe:/a:redhat:rhosemc:1.0::el8 | 1.0 | — | Red Hat |
| cpe:/a:redhat:openshift_serverless:1.36::el8 | 1.36 | — | Red Hat |
| cpe:/a:redhat:cert_manager:1.16::el9 | 1.16 | — | Red Hat |
| cpe:/a:redhat:openshift_compliance_operator:1::el9 | 1 | — | Red Hat |
| cpe:/a:redhat:discovery:2::el9 | 2 | — | Red Hat |
| cpe:/a:redhat:insights_proxy:1.5::el9 | 1.5 | — | Red Hat |
| cpe:/a:redhat:openshift_distributed_tracing:3.6::el8 | 3.6 | — | Red Hat |
| cpe:/a:redhat:confidential_compute_attestation:1.10::el9 | 1.10 | — | Red Hat |
- cpe:/o:redhat:rhel_tus:8.8::baseos Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.0::baseos Versions 9.0 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.2::baseos Versions 9.2 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
- cpe:/o:redhat:rhel_eus:9.4::baseos Versions 9.4 — ·Red Hat
- cpe:/a:redhat:webterminal:1.11::el9 Versions 1.11 — ·Red Hat
- cpe:/a:redhat:webterminal:1.12::el9 Versions 1.12 — ·Red Hat
- cpe:/a:redhat:rhosemc:1.0::el8 Versions 1.0 — ·Red Hat
- cpe:/a:redhat:openshift_serverless:1.36::el8 Versions 1.36 — ·Red Hat
- cpe:/a:redhat:cert_manager:1.16::el9 Versions 1.16 — ·Red Hat
- cpe:/a:redhat:openshift_compliance_operator:1::el9 Versions 1 — ·Red Hat
- cpe:/a:redhat:discovery:2::el9 Versions 2 — ·Red Hat
- cpe:/a:redhat:insights_proxy:1.5::el9 Versions 1.5 — ·Red Hat
- cpe:/a:redhat:openshift_distributed_tracing:3.6::el8 Versions 3.6 — ·Red Hat
- cpe:/a:redhat:confidential_compute_attestation:1.10::el9 Versions 1.10 — ·Red Hat
Remediation
- Fix · CNA linux-pam Fixed in 1.7.1
Red Hat 26 advisories
- RHSA-2026:0934 Released 2026-01-22 · Red Hat rating ImportantRelease of OpenShift Serverless Logic 1.36.0 security update & enhancements
- 8Base-Openshift-Serverless-1.36 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-db-migrator-tool-rhel8 +8
- RHSA-2025:22019 Released 2025-11-25 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) pam-devel-1.6.1-8.el10_0
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) pam-1.6.1-8.el10_0, pam-libs-1.6.1-8.el10_0
- RHSA-2025:21885 Released 2025-11-20 · Red Hat rating ImportantOpenShift Compliance Operator bug fix and enhancement update
- OpenShift Compliance Operator 1 registry.redhat.io/compliance/openshift-compliance-content-rhel8, registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8, registry.redhat.io/compliance/openshift-compliance-openscap-rhel8 +1
Show 23 more Red Hat advisories
- RHSA-2025:20181 Released 2025-11-11 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream (v. 10) pam-devel-1.6.1-8.el10
- Red Hat Enterprise Linux BaseOS (v. 10) pam-1.6.1-8.el10, pam-libs-1.6.1-8.el10
- RHSA-2025:18219 Released 2025-10-16 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.16.0
- cert-manager operator for Red Hat OpenShift 1.16 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2025:17181 Released 2025-10-01 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- RHSA-2025:16524 Released 2025-09-23 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9
- RHSA-2025:15828 Released 2025-09-15 · Red Hat rating Importantupdated web-terminal/tooling container image
- Red Hat Web Terminal 1.11 on RHEL 9 web-terminal/web-terminal-rhel9-operator, web-terminal/web-terminal-tooling-rhel9
- RHSA-2025:15827 Released 2025-09-15 · Red Hat rating Importantupdated web-terminal/tooling container image
- Red Hat Web Terminal 1.12 on RHEL 9 web-terminal/web-terminal-tooling-rhel9
- RHSA-2025:15709 Released 2025-09-11 · Red Hat rating ImportantRed Hat OpenShift sandboxed containers release
- Red Hat OpenShift sandboxed containers 1.10 registry.redhat.io/openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, registry.redhat.io/openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9, registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel9 +4
- RHSA-2025:15099 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream (v. 9) pam-devel-1.5.1-26.el9_6, pam-docs-1.5.1-26.el9_6
- Red Hat Enterprise Linux BaseOS (v. 9) pam-1.5.1-26.el9_6
- RHSA-2025:14557 Released 2025-08-26 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS (v. 8) pam-1.3.1-38.el8_10, pam-devel-1.3.1-38.el8_10
- RHSA-2025:11487 Released 2025-07-21 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9
- RHSA-2025:11386 Released 2025-07-17 · Red Hat rating Importantupdated RHEL-8 based Middleware Containers container images
- Middleware Containers for OpenShift rhpam-7/rhpam-businesscentral-monitoring-rhel8, rhpam-7/rhpam-businesscentral-rhel8, rhpam-7/rhpam-controller-rhel8 +6
- RHSA-2025:10823 Released 2025-07-10 · Red Hat rating ImportantRed Hat build of Tempo 3.6.1 release
- Red Hat OpenShift distributed tracing 3.6.0 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8, registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel8 +3
- RHSA-2025:10735 Released 2025-07-09 · Red Hat rating ImportantRed Hat build of OpenTelemetry 3.6.1 release
- Red Hat OpenShift distributed tracing 3.6.0 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
- RHSA-2025:10354 Released 2025-07-07 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) pam-devel-1.5.1-9.el9_0.2, pam-docs-1.5.1-9.el9_0.2
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) pam-1.5.1-9.el9_0.2
- RHSA-2025:10359 Released 2025-07-07 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) pam-1.3.1-16.el8_6.2, pam-devel-1.3.1-16.el8_6.2
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) pam-1.3.1-16.el8_6.2, pam-devel-1.3.1-16.el8_6.2
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) pam-1.3.1-16.el8_6.2, pam-devel-1.3.1-16.el8_6.2
- RHSA-2025:10357 Released 2025-07-07 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux Server (v. 7 ELS) pam-1.1.8-23.el7_9.1, pam-1.1.8-23.el7_9.1.ppc, pam-devel-1.1.8-23.el7_9.1 +1
- RHSA-2025:10358 Released 2025-07-07 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) pam-1.3.1-26.el8_8.1, pam-devel-1.3.1-26.el8_8.1
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) pam-1.3.1-26.el8_8.1, pam-devel-1.3.1-26.el8_8.1
- RHSA-2025:10362 Released 2025-07-07 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) pam-1.3.1-8.el8_2.1, pam-devel-1.3.1-8.el8_2.1
- RHSA-2025:10361 Released 2025-07-07 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) pam-1.3.1-14.el8_4.1, pam-devel-1.3.1-14.el8_4.1
- RHSA-2025:10180 Released 2025-07-02 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) pam-devel-1.5.1-15.el9_2.1, pam-docs-1.5.1-15.el9_2.1
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) pam-1.5.1-15.el9_2.1
- RHSA-2025:10027 Released 2025-07-01 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS (v. 8) pam-1.3.1-37.el8_10, pam-devel-1.3.1-37.el8_10
- RHSA-2025:10024 Released 2025-07-01 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) pam-devel-1.5.1-24.el9_4, pam-docs-1.5.1-24.el9_4
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) pam-1.5.1-24.el9_4
- RHSA-2025:9526 Released 2025-06-24 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream (v. 9) pam-devel-1.5.1-25.el9_6, pam-docs-1.5.1-25.el9_6
- Red Hat Enterprise Linux BaseOS (v. 9) pam-1.5.1-25.el9_6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| 8Base-Openshift-Serverless-1.36 | Fixed | RHSA-2026:0934 |
| Middleware Containers for OpenShift | Fixed | RHSA-2025:11386 |
| OpenShift Compliance Operator 1 | Fixed | RHSA-2025:21885 |
| Red Hat Discovery 2 | Fixed | RHSA-2025:11487, RHSA-2025:16524 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:20181 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:15099, RHSA-2025:9526 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:10354 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:10180 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2025:22019 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:10024 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2025:20181 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:10027, RHSA-2025:14557 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:15099, RHSA-2025:9526 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2025:10362 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2025:10361 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2025:10359 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2025:10359 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2025:10358 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2025:10354 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2025:10180 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2025:22019 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2025:10024 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2025:10359 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2025:10358 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:10357 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2025:17181 |
| Red Hat OpenShift distributed tracing 3.6.0 | Fixed | RHSA-2025:10735, RHSA-2025:10823 |
| Red Hat OpenShift sandboxed containers 1.10 | Fixed | RHSA-2025:15709 |
| Red Hat Web Terminal 1.11 on RHEL 9 | Fixed | RHSA-2025:15828 |
| Red Hat Web Terminal 1.12 on RHEL 9 | Fixed | RHSA-2025:15827 |
| cert-manager operator for Red Hat OpenShift 1.16 | Fixed | RHSA-2025:18219 |
Not affected: 5 products
- OpenShift Compliance Operator 1
- Red Hat Discovery 2
- Red Hat OpenShift distributed tracing 3.6.0
- Red Hat OpenShift sandboxed containers 1.10
- cert-manager operator for Red Hat OpenShift 1.16
Timeline
- 2026-10-02 Threatist record created from CVE-2025-6020
- 2026-10-07 Affected versions changed · CNA
- 2026-10-07 Fix available: Red Hat OpenShift sandboxed containers 1.10 · Red Hat
- 2026-10-12 Affected versions changed · CNA
- 2026-10-13 Fix available: Compliance Operator 1 · Red Hat
- 2026-11-06 Affected versions changed · CNA
- 2026-11-06 Fix available: OpenShift Compliance Operator 1 · Red Hat
References
Advisory 26
- RHSA-2025:10024
- RHSA-2025:10027
- RHSA-2025:10180
- RHSA-2025:10354
- RHSA-2025:10357
- RHSA-2025:10358
- RHSA-2025:10359
- RHSA-2025:10361
- RHSA-2025:10362
- RHSA-2025:10735
- RHSA-2025:10823
- RHSA-2025:11386
- RHSA-2025:11487
- RHSA-2025:14557
- RHSA-2025:15099
- RHSA-2025:15709
- RHSA-2025:15827
- RHSA-2025:15828
- RHSA-2025:16524
- RHSA-2025:17181
- RHSA-2025:18219
- RHSA-2025:20181
- RHSA-2025:21885
- RHSA-2025:22019
- RHSA-2025:9526
- RHSA-2026:0934
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-6020 · CVE Program
- CVE-2025-6020 · NVD
- FIRST EPSS
- CVE-2025-6020 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences