Skip to content
Fencer Vulns
high 7.8

CVE-2025-6020 json

Linux-pam: linux-pam directory traversal

published 2025-06-17 16 mo ago modified 2026-11-06 3 d ago also EUVD-2025-19056

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:1.6.1-8.el10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.6.1-8.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.1.8-23.el7_9.1
  • Red Hat Red Hat Enterprise Linux 8 0:1.3.1-37.el8_10, 0:1.3.1-38.el8_10
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.3.1-8.el8_2.1
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.3.1-14.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.3.1-16.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.3.1-16.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.3.1-16.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.3.1-26.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.3.1-26.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:1.5.1-25.el9_6, 0:1.5.1-26.el9_6
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.5.1-9.el9_0.2
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.5.1-15.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.5.1-24.el9_4
  • Red Hat Red Hat Web Terminal 1.11 on RHEL 9 1.11-8, 1.11-19
  • Red Hat Red Hat Web Terminal 1.12 on RHEL 9 1.12-4
  • Red Hat RHEL-8 based Middleware Containers 7.13.5-2.1752065733, 7.13.5-3.1752065737, 7.13.5-4.1752065731, 7.13.5-4.1752065732, 7.13.5-4.1752065736, 7.13.5-4.1752065755, 7.13.5-4.1752066672, 7.13.5-25
  • Red Hat RHOSS-1.36-RHEL-8 1.36.0-4, 1.36.0-7, 1.36.0-9, 1.36.0-10, 1.36.0-11, 1.36.0-12, 1.36.0-18
  • Red Hat cert-manager operator for Red Hat OpenShift 1.16 v1.16.5-1760515757
  • Red Hat OpenShift Compliance Operator 1 1.8.0
  • Red Hat Red Hat Discovery 2 2.0.0-1752592913, 2.2.1-1758555934
  • Red Hat Red Hat Insights proxy 1.5 1.5.7-1759331989
  • Red Hat Red Hat OpenShift distributed tracing 3.6.0 rhosdt-3.6-1751993590, rhosdt-3.6-1752046437, rhosdt-3.6-1752046439, rhosdt-3.6-1752046452, rhosdt-3.6-1752070827, rhosdt-3.6-1752070833, rhosdt-3.6-1752070865, rhosdt-3.6-1752070866, rhosdt-3.6-1752070873
  • Red Hat Red Hat OpenShift sandboxed containers 1.10 1.10.2-1757421804, 1.10.2-1757421879, 1.10.2-1757422110, 1.10.2-1757422401
  • Siemens RUGGEDCOM ROX MX5000 V2.17.1
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.1
  • Siemens RUGGEDCOM ROX RX1400 V2.17.1
  • Siemens RUGGEDCOM ROX RX1500 V2.17.1
  • Siemens RUGGEDCOM ROX RX1501 V2.17.1
  • pam Debian 12 1.5.2-6+deb12u2
  • pam Debian 14, Debian 13 1.7.0-5

debian advisories DEBIAN-CVE-2025-6020

  • pam Ubuntu 22.04 LTS 1.4.0-11ubuntu2.6
  • pam Ubuntu 24.04 LTS 1.5.3-5ubuntu5.4
  • pam Ubuntu 25.10 1.5.3-7ubuntu6

ubuntu advisories UBUNTU-CVE-2025-6020

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • pam RHEL 10.1 1.6.1-8.el10
  • pam-libs RHEL 10.1 1.6.1-8.el10
  • pam RHEL 9 1.5.1-26.el9_6
  • pam RHEL 8 1.3.1-38.el8_10
  • pam RHEL 8 1.3.1-37.el8_10
  • pam RHEL 9 1.5.1-25.el9_6
  • pam enterprise linux eus 10.0 1.6.1-8.el10_0
  • pam-libs enterprise linux eus 10.0 1.6.1-8.el10_0

red hat advisories RHSA-2025:22019RHSA-2025:20181RHSA-2025:15099RHSA-2025:14557RHSA-2025:10361RHSA-2025:10362

  • pam Linux Micro 6.0 1.6.0-5.1
  • pam Linux Micro 6.1 1.6.1-slfo.1.1_3.1
  • pam SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +21 more 1.3.0-150000.6.83.1

suse advisories SUSE-SU-2025:20427-1SUSE-SU-2025:20441-1SUSE-SU-2025:02013-1

  • pam openSUSE Tumbleweed 1.7.1-1.1

opensuse advisories openSUSE-SU-2025:15256-1

  • pam AlmaLinux 10 1.6.1-8.el10
  • pam-libs AlmaLinux 10 1.6.1-8.el10
  • pam AlmaLinux 9 1.5.1-26.el9_6
  • pam AlmaLinux 8 1.3.1-38.el8_10
  • pam AlmaLinux 8 1.3.1-37.el8_10
  • pam AlmaLinux 9 1.5.1-25.el9_6

almalinux advisories ALSA-2025:20181ALSA-2025:15099ALSA-2025:14557ALSA-2025:10027ALSA-2025:9526

  • pam Rocky Linux 10 1.6.1-8.el10
  • pam Rocky Linux 9 1.5.1-26.el9_6
  • pam Rocky Linux 9 1.5.1-25.el9_6
  • pam Rocky Linux 8 1.3.1-38.el8_10
  • pam Rocky Linux 8 1.3.1-37.el8_10

rocky linux advisories RLSA-2025:20181RLSA-2025:15099RLSA-2025:9526RLSA-2025:14557RLSA-2025:10027

  • pam CBL-Mariner 2.0 1.5.1-8
  • pam Azure Linux 3.0 1.5.3-5

azure linux advisories AZL-64113AZL-64142

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-6020 updated cvss 7.8

linux-pam: Linux-pam directory Traversal

  • Red Hat cert-manager operator for Red Hat OpenShift 1.16 cert-manager v1.16.5-1760515757
    fixed: vendor fix RHSA-2025:18219
  • Red Hat Middleware Containers for OpenShift rhpam-7/rhpam-operator-bundle 7.13.5-25, rhpam-7/rhpam-rhel8-operator 7.13.5-2.1752065733, rhpam-7/rhpam-kieserver-rhel8 7.13.5-4.1752065731, rhpam-7/rhpam-controller-rhel8 7.13.5-4.1752065732, rhpam-7/rhpam-dashbuilder-rhel8 7.13.5-3.1752065737, rhpam-7/rhpam-smartrouter-rhel8 7.13.5-4.1752065755, +3 more
    fixed: vendor fix RHSA-2025:11386
  • Red Hat OpenShift Compliance Operator 1 compliance
    fixed: vendor fix RHSA-2025:21885
  • Red Hat Discovery 2 discovery 2.0.0-1752592913, discovery 2.2.1-1758555934
    fixed: vendor fix RHSA-2025:16524
  • Red Hat Enterprise Linux AppStream (v. 9) pam-docs 1.5.1-25.el9_6, pam-docs 1.5.1-26.el9_6, pam-devel 1.5.1-25.el9_6, pam-devel 1.5.1-26.el9_6, pam-debuginfo 1.5.1-25.el9_6, pam-debuginfo 1.5.1-26.el9_6, +2 more
    fixed: vendor fix RHSA-2025:9526
  • Red Hat Enterprise Linux AppStream (v. 10) pam-devel 1.6.1-8.el10, pam-debuginfo 1.6.1-8.el10, pam-debugsource 1.6.1-8.el10, pam-libs-debuginfo 1.6.1-8.el10
    fixed: vendor fix RHSA-2025:20181
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) pam-docs 1.5.1-9.el9_0.2, pam-devel 1.5.1-9.el9_0.2, pam-debuginfo 1.5.1-9.el9_0.2, pam-debugsource 1.5.1-9.el9_0.2
    fixed: vendor fix RHSA-2025:10354
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) pam-docs 1.5.1-15.el9_2.1, pam-devel 1.5.1-15.el9_2.1, pam-debuginfo 1.5.1-15.el9_2.1, pam-debugsource 1.5.1-15.el9_2.1
    fixed: vendor fix RHSA-2025:10180
show 23 more
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) pam-devel 1.6.1-8.el10_0, pam-debuginfo 1.6.1-8.el10_0, pam-debugsource 1.6.1-8.el10_0, pam-libs-debuginfo 1.6.1-8.el10_0
    fixed: vendor fix RHSA-2025:22019
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) pam-docs 1.5.1-24.el9_4, pam-devel 1.5.1-24.el9_4, pam-debuginfo 1.5.1-24.el9_4, pam-debugsource 1.5.1-24.el9_4
    fixed: vendor fix RHSA-2025:10024
  • Red Hat Enterprise Linux BaseOS (v. 8) pam 1.3.1-37.el8_10, pam 1.3.1-38.el8_10
    fixed: vendor fix RHSA-2025:10027
  • Red Hat Enterprise Linux BaseOS (v. 9) pam 1.5.1-25.el9_6, pam 1.5.1-26.el9_6
    fixed: vendor fix RHSA-2025:9526
  • Red Hat Enterprise Linux BaseOS (v. 10) pam 1.6.1-8.el10, pam-libs 1.6.1-8.el10
    fixed: vendor fix RHSA-2025:20181
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) pam 1.3.1-8.el8_2.1
    fixed: vendor fix RHSA-2025:10362
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) pam 1.3.1-14.el8_4.1
    fixed: vendor fix RHSA-2025:10361
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) pam 1.3.1-16.el8_6.2 Red Hat Enterprise Linux BaseOS E4S (v.8.6) pam 1.3.1-16.el8_6.2
    fixed: vendor fix RHSA-2025:10359
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) pam 1.3.1-26.el8_8.1
    fixed: vendor fix RHSA-2025:10358
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) pam 1.5.1-9.el9_0.2
    fixed: vendor fix RHSA-2025:10354
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) pam 1.5.1-15.el9_2.1
    fixed: vendor fix RHSA-2025:10180
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) pam 1.6.1-8.el10_0, pam-libs 1.6.1-8.el10_0
    fixed: vendor fix RHSA-2025:22019
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) pam 1.5.1-24.el9_4
    fixed: vendor fix RHSA-2025:10024
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) pam 1.3.1-16.el8_6.2
    fixed: vendor fix RHSA-2025:10359
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) pam 1.3.1-26.el8_8.1
    fixed: vendor fix RHSA-2025:10358
  • Red Hat Enterprise Linux Server (v. 7 ELS) pam 1.1.8-23.el7_9.1
    fixed: vendor fix RHSA-2025:10357
  • Red Hat Insights proxy 1.5 insights-proxy 1.5.7-1759331989
    fixed: vendor fix RHSA-2025:17181
  • Red Hat OpenShift distributed tracing 3.6.0 rhosdt rhosdt-3.6-1751993590, rhosdt rhosdt-3.6-1752046437, rhosdt rhosdt-3.6-1752046439, rhosdt rhosdt-3.6-1752046452, rhosdt rhosdt-3.6-1752070827, rhosdt rhosdt-3.6-1752070833, +3 more
    fixed: vendor fix RHSA-2025:10735
  • Red Hat OpenShift sandboxed containers 1.10 openshift-sandboxed-containers 1.10.2-1757421804, openshift-sandboxed-containers 1.10.2-1757421879, openshift-sandboxed-containers 1.10.2-1757422110, openshift-sandboxed-containers 1.10.2-1757422401
    fixed: vendor fix RHSA-2025:15709
  • Red Hat OpenShift Serverless 1.36 openshift-serverless-1/logic-rhel8-operator 1.36.0-18, openshift-serverless-1/logic-operator-bundle 1.36.0-12, openshift-serverless-1/logic-swf-devmode-rhel8 1.36.0-7, openshift-serverless-1/logic-swf-builder-rhel8 1.36.0-11, openshift-serverless-1/logic-db-migrator-tool-rhel8 1.36.0-11, openshift-serverless-1/logic-management-console-rhel8 1.36.0-9, +5 more
    fixed: vendor fix RHSA-2026:0934
  • Red Hat Web Terminal 1.11 on RHEL 9 web-terminal/web-terminal-tooling-rhel9 1.11-8, web-terminal/web-terminal-rhel9-operator 1.11-19
    fixed: vendor fix RHSA-2025:15828
  • Red Hat Web Terminal 1.12 on RHEL 9 web-terminal/web-terminal-tooling-rhel9 1.12-4
    fixed: vendor fix RHSA-2025:15827
  • Red Hat cert-manager operator for Red Hat OpenShift 1.16 cert-manager v1.16.5-1760509690 Red Hat OpenShift Compliance Operator 1 compliance Red Hat Discovery 2 discovery 2.0.0-1752593703, discovery 2.2.0-1758132611 Red Hat OpenShift distributed tracing 3.6.0 rhosdt rhosdt-3.6-1752053203, rhosdt rhosdt-3.6-1752120292 Red Hat OpenShift sandboxed containers 1.10 openshift-sandboxed-containers 1.10.2-1757421846, openshift-sandboxed-containers 1.10.2-1757421890, openshift-sandboxed-containers 1.10.2-1757422070, openshift-sandboxed-containers 1.10.2-1757428967, openshift-sandboxed-containers 1.10.2-1757430223
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-134-16 updated cvss 7.8

Siemens Ruggedcom Rox

  • Siemens RUGGEDCOM ROX MX5000 < 2.17.1 Siemens RUGGEDCOM ROX MX5000RE < 2.17.1 Siemens RUGGEDCOM ROX RX1400 < 2.17.1 Siemens RUGGEDCOM ROX RX1500 < 2.17.1 Siemens RUGGEDCOM ROX RX1501 < 2.17.1 Siemens RUGGEDCOM ROX RX1510 < 2.17.1
    +5 more products
    Siemens RUGGEDCOM ROX RX1511 < 2.17.1 Siemens RUGGEDCOM ROX RX1512 < 2.17.1 Siemens RUGGEDCOM ROX RX1524 < 2.17.1 Siemens RUGGEDCOM ROX RX1536 < 2.17.1 Siemens RUGGEDCOM ROX RX5000 < 2.17.1
    affected: fixed in V2.17.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
16 mo ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Web Terminal 1.11 on RHEL 9
  • Red Hat Red Hat Web Terminal 1.12 on RHEL 9
  • Red Hat RHEL-8 based Middleware Containers
  • Red Hat RHOSS-1.36-RHEL-8
  • Red Hat cert-manager operator for Red Hat OpenShift 1.16
  • Red Hat OpenShift Compliance Operator 1
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Insights proxy 1.5
  • Red Hat Red Hat OpenShift distributed tracing 3.6.0
  • Red Hat Red Hat OpenShift sandboxed containers 1.10
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.