Linux-pam: incomplete fix for cve-2025-6020
Priority LOW 36CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed Red Hat: 18 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | linux-pam | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | 1.1.8-23.el7_9.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.3.1-38.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 1.3.1-8.el8_2.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 1.3.1-14.el8_4.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | 1.3.1-14.el8_4.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 1.3.1-16.el8_6.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 1.3.1-16.el8_6.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 1.3.1-16.el8_6.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 1.3.1-26.el8_8.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 1.3.1-26.el8_8.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.5.1-26.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.5.1-26.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 1.5.1-9.el9_0.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 1.5.1-15.el9_2.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 1.5.1-24.el9_4.1 | Patch available | CNA |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — | 1.11-19 | Patch available | CNA |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — | 1.11-8 | Patch available | CNA |
| Red Hat | Red Hat Web Terminal 1.12 on RHEL 9 | — | 1.12-4 | Patch available | CNA |
| Red Hat | cert-manager operator for Red Hat OpenShift 1.16 | — | sha256:330e8b5ab4841a21f8f5f23cc7fb192197872f11639b12bf4b1e70831f636323 | Patch available | CNA |
| Red Hat | Compliance Operator 1 | — | sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628 | Patch available | CNA |
| Red Hat | Red Hat Discovery 2 | — | sha256:c85cfbcaf7888885e57596b7b8bde3894718cfc33326499b24961a66a62cf083 | Patch available | CNA |
| Red Hat | Red Hat Insights proxy 1.5 | — | sha256:4ca38b33efec0d2dd17a8fd822a7c18281810676ceabb0c1db90953cb91cd5ea | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.1 | — | sha256:24722900db1425bf0c27f6ad6f3fb7d79ff9ebc433bdab58423fa71bab76122b | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.1 | — | sha256:f5e1602d72177d77f1b879c76e6f6cfbc2979c136c06ca9f03ea97ffb369b7a6 | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.1 | — | sha256:cead623ceda4048cabaa81c371ed2a8143f5c5514276fca1d71685bd9e6d1e65 | Patch available | CNA |
| Red Hat | Red Hat OpenShift sandboxed containers 1.1 | — | sha256:59fb1f7f1653361d94f7d48b42d8fe19ed3263c1c78654837c11f2135544c1ac | Patch available | CNA |
- linux-pam Vendor— Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.1.8-23.el7_9.2 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.3.1-38.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1.3.1-8.el8_2.2 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.3.1-14.el8_4.2 Patch available CNA
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 1.3.1-14.el8_4.2 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.3.1-16.el8_6.3 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.3.1-16.el8_6.3 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.3.1-16.el8_6.3 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.3.1-26.el8_8.2 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.3.1-26.el8_8.2 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.1-26.el9_6 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.5.1-26.el9_6 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.5.1-9.el9_0.3 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.5.1-15.el9_2.2 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 1.5.1-24.el9_4.1 Patch available CNA
- Red Hat Web Terminal 1.11 on RHEL 9 VendorRed Hat Affected — Fixed in 1.11-19 Patch available CNA
- Red Hat Web Terminal 1.11 on RHEL 9 VendorRed Hat Affected — Fixed in 1.11-8 Patch available CNA
- Red Hat Web Terminal 1.12 on RHEL 9 VendorRed Hat Affected — Fixed in 1.12-4 Patch available CNA
- cert-manager operator for Red Hat OpenShift 1.16 VendorRed Hat Affected — Fixed in sha256:330e8b5ab4841a21f8f5f23cc7fb192197872f11639b12bf4b1e70831f636323 Patch available CNA
- Compliance Operator 1 VendorRed Hat Affected — Fixed in sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628 Patch available CNA
- Red Hat Discovery 2 VendorRed Hat Affected — Fixed in sha256:c85cfbcaf7888885e57596b7b8bde3894718cfc33326499b24961a66a62cf083 Patch available CNA
- Red Hat Insights proxy 1.5 VendorRed Hat Affected — Fixed in sha256:4ca38b33efec0d2dd17a8fd822a7c18281810676ceabb0c1db90953cb91cd5ea Patch available CNA
- Red Hat OpenShift sandboxed containers 1.1 VendorRed Hat Affected — Fixed in sha256:24722900db1425bf0c27f6ad6f3fb7d79ff9ebc433bdab58423fa71bab76122b Patch available CNA
- Red Hat OpenShift sandboxed containers 1.1 VendorRed Hat Affected — Fixed in sha256:f5e1602d72177d77f1b879c76e6f6cfbc2979c136c06ca9f03ea97ffb369b7a6 Patch available CNA
- Red Hat OpenShift sandboxed containers 1.1 VendorRed Hat Affected — Fixed in sha256:cead623ceda4048cabaa81c371ed2a8143f5c5514276fca1d71685bd9e6d1e65 Patch available CNA
- Red Hat OpenShift sandboxed containers 1.1 VendorRed Hat Affected — Fixed in sha256:59fb1f7f1653361d94f7d48b42d8fe19ed3263c1c78654837c11f2135544c1ac Patch available CNA
CPE names CNA · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:8::baseos | 8 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.2::baseos | 8.2 | — | Red Hat |
| cpe:/o:redhat:rhel_eus_long_life:8.4::baseos | 8.4 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.4::baseos | 8.4 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_tus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.8::baseos | 8.8 | — | Red Hat |
| cpe:/o:redhat:rhel_tus:8.8::baseos | 8.8 | — | Red Hat |
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.2::baseos Versions 8.2 — ·Red Hat
- cpe:/o:redhat:rhel_eus_long_life:8.4::baseos Versions 8.4 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.4::baseos Versions 8.4 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_tus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.8::baseos Versions 8.8 — ·Red Hat
- cpe:/o:redhat:rhel_tus:8.8::baseos Versions 8.8 — ·Red Hat
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:9::baseos | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.0::baseos | 9.0 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.2::baseos | 9.2 | — | Red Hat |
| cpe:/o:redhat:rhel_eus:9.4::baseos | 9.4 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.4::appstream | 9.4 | — | Red Hat |
| cpe:/a:redhat:webterminal:1.11::el9 | 1.11 | — | Red Hat |
| cpe:/a:redhat:webterminal:1.12::el9 | 1.12 | — | Red Hat |
| cpe:/a:redhat:cert_manager:1.16::el9 | 1.16 | — | Red Hat |
| cpe:/a:redhat:openshift_compliance_operator:1::el9 | 1 | — | Red Hat |
| cpe:/a:redhat:discovery:2::el9 | 2 | — | Red Hat |
| cpe:/a:redhat:insights_proxy:1.5::el9 | 1.5 | — | Red Hat |
| cpe:/a:redhat:confidential_compute_attestation:1.10::el9 | 1.10 | — | Red Hat |
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.0::baseos Versions 9.0 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.2::baseos Versions 9.2 — ·Red Hat
- cpe:/o:redhat:rhel_eus:9.4::baseos Versions 9.4 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
- cpe:/a:redhat:webterminal:1.11::el9 Versions 1.11 — ·Red Hat
- cpe:/a:redhat:webterminal:1.12::el9 Versions 1.12 — ·Red Hat
- cpe:/a:redhat:cert_manager:1.16::el9 Versions 1.16 — ·Red Hat
- cpe:/a:redhat:openshift_compliance_operator:1::el9 Versions 1 — ·Red Hat
- cpe:/a:redhat:discovery:2::el9 Versions 2 — ·Red Hat
- cpe:/a:redhat:insights_proxy:1.5::el9 Versions 1.5 — ·Red Hat
- cpe:/a:redhat:confidential_compute_attestation:1.10::el9 Versions 1.10 — ·Red Hat
Remediation
Red Hat 18 advisories
- RHSA-2026:0934 Released 2026-01-22 · Red Hat rating ImportantRelease of OpenShift Serverless Logic 1.36.0 security update & enhancements
- 8Base-Openshift-Serverless-1.36 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-db-migrator-tool-rhel8 +8
- RHSA-2025:21885 Released 2025-11-20 · Red Hat rating ImportantOpenShift Compliance Operator bug fix and enhancement update
- OpenShift Compliance Operator 1 registry.redhat.io/compliance/openshift-compliance-content-rhel8, registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8, registry.redhat.io/compliance/openshift-compliance-openscap-rhel8 +1
- RHSA-2025:18219 Released 2025-10-16 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.16.0
- cert-manager operator for Red Hat OpenShift 1.16 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
Show 15 more Red Hat advisories
- RHSA-2025:17181 Released 2025-10-01 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- RHSA-2025:16524 Released 2025-09-23 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9
- RHSA-2025:15828 Released 2025-09-15 · Red Hat rating Importantupdated web-terminal/tooling container image
- Red Hat Web Terminal 1.11 on RHEL 9 web-terminal/web-terminal-rhel9-operator, web-terminal/web-terminal-tooling-rhel9
- RHSA-2025:15827 Released 2025-09-15 · Red Hat rating Importantupdated web-terminal/tooling container image
- Red Hat Web Terminal 1.12 on RHEL 9 web-terminal/web-terminal-tooling-rhel9
- RHSA-2025:15709 Released 2025-09-11 · Red Hat rating ImportantRed Hat OpenShift sandboxed containers release
- Red Hat OpenShift sandboxed containers 1.10 registry.redhat.io/openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, registry.redhat.io/openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9, registry.redhat.io/openshift-sandboxed-containers/osc-monitor-rhel9 +4
- RHSA-2025:15102 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) pam-devel-1.5.1-24.el9_4.1, pam-docs-1.5.1-24.el9_4.1
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) pam-1.5.1-24.el9_4.1
- RHSA-2025:15106 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux Server (v. 7 ELS) pam-1.1.8-23.el7_9.2, pam-1.1.8-23.el7_9.2.ppc, pam-devel-1.1.8-23.el7_9.2 +1
- RHSA-2025:15105 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) pam-1.3.1-16.el8_6.3, pam-devel-1.3.1-16.el8_6.3
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) pam-1.3.1-16.el8_6.3, pam-devel-1.3.1-16.el8_6.3
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) pam-1.3.1-16.el8_6.3, pam-devel-1.3.1-16.el8_6.3
- RHSA-2025:15103 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) pam-1.3.1-26.el8_8.2, pam-devel-1.3.1-26.el8_8.2
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) pam-1.3.1-26.el8_8.2, pam-devel-1.3.1-26.el8_8.2
- RHSA-2025:15104 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) pam-1.3.1-14.el8_4.2, pam-devel-1.3.1-14.el8_4.2
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) pam-1.3.1-14.el8_4.2, pam-devel-1.3.1-14.el8_4.2
- RHSA-2025:15101 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) pam-devel-1.5.1-15.el9_2.2, pam-docs-1.5.1-15.el9_2.2
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) pam-1.5.1-15.el9_2.2
- RHSA-2025:15107 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) pam-1.3.1-8.el8_2.2, pam-devel-1.3.1-8.el8_2.2
- RHSA-2025:15099 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream (v. 9) pam-devel-1.5.1-26.el9_6, pam-docs-1.5.1-26.el9_6
- Red Hat Enterprise Linux BaseOS (v. 9) pam-1.5.1-26.el9_6
- RHSA-2025:15100 Released 2025-09-03 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) pam-devel-1.5.1-9.el9_0.3, pam-docs-1.5.1-9.el9_0.3
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) pam-1.5.1-9.el9_0.3
- RHSA-2025:14557 Released 2025-08-26 · Red Hat rating Importantpam security update
- Red Hat Enterprise Linux BaseOS (v. 8) pam-1.3.1-38.el8_10, pam-devel-1.3.1-38.el8_10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| 8Base-Openshift-Serverless-1.36 | Fixed | RHSA-2026:0934 |
| Compliance Operator 1 | Fixed | RHSA-2025:21885 |
| Red Hat Discovery 2 | Fixed | RHSA-2025:16524 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:15099 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:15100 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:15101 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:15102 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:14557 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:15099 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2025:15107 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2025:15104 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2025:15105 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2025:15105 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2025:15103 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2025:15100 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2025:15101 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2025:15102 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:15104 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2025:15105 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2025:15103 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:15106 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2025:17181 |
| Red Hat OpenShift sandboxed containers 1.10 | Fixed | RHSA-2025:15709 |
| Red Hat Web Terminal 1.11 on RHEL 9 | Fixed | RHSA-2025:15828 |
| Red Hat Web Terminal 1.12 on RHEL 9 | Fixed | RHSA-2025:15827 |
| cert-manager operator for Red Hat OpenShift 1.16 | Fixed | RHSA-2025:18219 |
Not affected: 4 products
- Compliance Operator 1
- Red Hat Discovery 2
- Red Hat OpenShift sandboxed containers 1.10
- cert-manager operator for Red Hat OpenShift 1.16
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8941
- 2026-10-03 Alias added: GHSA-hqqx-rjqh-53c2
- 2026-10-07 Fix available: Red Hat OpenShift sandboxed containers 1.10 · Red Hat
- 2026-10-13 Fix available: Compliance Operator 1 · Red Hat
References
Advisory 17
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-8941 · CVE Program
- CVE-2025-8941 · NVD
- FIRST EPSS
- GHSA-hqqx-rjqh-53c2 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-8941 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences