IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.8High

CVE-2025-6020Linux-pam: linux-pam directory traversal

linux-pam; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Life… Published: (1 year ago)

Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Weakness (CWE): CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
cert manager 1.16 —
confidential compute attestation 1.10 —
discovery 2 —
enterprise linux 8 —
enterprise linux 9 —
insights proxy 1.5 —
openshift compliance operator 1 —
openshift distributed tracing 3.6 —
openshift serverless 1.36 —
Red Hat cert-manager operator for Red Hat OpenShift 1.16 all versions
Red Hat OpenShift Compliance Operator 1 all versions
Red Hat Red Hat Discovery 2 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support all versions
Red Hat Red Hat Insights proxy 1.5 all versions
Red Hat Red Hat OpenShift distributed tracing 3.6.0 all versions
Red Hat Red Hat OpenShift sandboxed containers 1.10 all versions
Red Hat Red Hat Web Terminal 1.11 on RHEL 9 all versions
Red Hat Red Hat Web Terminal 1.12 on RHEL 9 all versions
Red Hat RHEL-8 based Middleware Containers all versions
Red Hat RHOSS-1.36-RHEL-8 all versions
rhel aus 8.2 —
rhel aus 8.4 —
rhel aus 8.6 —
rhel e4s 8.6 —
rhel e4s 8.8 —
rhel e4s 9.0 —
rhel e4s 9.2 —
rhel eus 9.4 —
rhel tus 8.6 —
rhel tus 8.8 —
rhosemc 1.0 —
Siemens RUGGEDCOM ROX MX5000 < V2.17.1
Siemens RUGGEDCOM ROX MX5000RE < V2.17.1
Siemens RUGGEDCOM ROX RX1400 < V2.17.1
Siemens RUGGEDCOM ROX RX1500 < V2.17.1
Siemens RUGGEDCOM ROX RX1501 < V2.17.1
Siemens RUGGEDCOM ROX RX1510 < V2.17.1
Siemens RUGGEDCOM ROX RX1511 < V2.17.1
Siemens RUGGEDCOM ROX RX1512 < V2.17.1
Siemens RUGGEDCOM ROX RX1524 < V2.17.1
Siemens RUGGEDCOM ROX RX1536 < V2.17.1
Siemens RUGGEDCOM ROX RX5000 < V2.17.1
— linux-pam < 1.7.1
webterminal 1.11 —
webterminal 1.12 —

References and patches

Recent CVEs in the same product — Red Hat Enterprise Linux

5.5Medium
CVE-2026-127101

Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication.…

5.5Medium
CVE-2026-127100

Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, t…

5.9Medium
CVE-2026-127099

Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized …

5.5Medium
CVE-2026-126831

Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copie…

7.9High
CVE-2026-121876

Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by ty…