CVE-2025-6020: Red Hat Cert-Manager Operator For Red Hat Openshift 1.16

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Affected products

Red Hat Cert-Manager Operator For Red Hat Openshift 1.16: before v1.16.5-1760515757 (fixed in v1.16.5-1760515757)
Red Hat Openshift Compliance Operator 1: before 1.8.0 (fixed in 1.8.0)
Red Hat Red Hat Discovery 2: before 2.0.0-1752592913 (fixed in 2.0.0-1752592913); before 2.2.1-1758555934 (fixed in 2.2.1-1758555934)
Red Hat Red Hat Enterprise Linux 10: before 0:1.6.1-8.el10 (fixed in 0:1.6.1-8.el10)
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:1.6.1-8.el10_0 (fixed in 0:1.6.1-8.el10_0)
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: before 0:1.1.8-23.el7_9.1 (fixed in 0:1.1.8-23.el7_9.1)
Red Hat Red Hat Enterprise Linux 8: before 0:1.3.1-37.el8_10 (fixed in 0:1.3.1-37.el8_10); before 0:1.3.1-38.el8_10 (fixed in 0:1.3.1-38.el8_10)
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support: before 0:1.3.1-8.el8_2.1 (fixed in 0:1.3.1-8.el8_2.1)
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 0:1.3.1-14.el8_4.1 (fixed in 0:1.3.1-14.el8_4.1)
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 0:1.3.1-16.el8_6.2 (fixed in 0:1.3.1-16.el8_6.2)
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: before 0:1.3.1-16.el8_6.2 (fixed in 0:1.3.1-16.el8_6.2)
Red Hat Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions: before 0:1.3.1-16.el8_6.2 (fixed in 0:1.3.1-16.el8_6.2)
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 0:1.3.1-26.el8_8.1 (fixed in 0:1.3.1-26.el8_8.1)
Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 0:1.3.1-26.el8_8.1 (fixed in 0:1.3.1-26.el8_8.1)
Red Hat Red Hat Enterprise Linux 9: before 0:1.5.1-26.el9_6 (fixed in 0:1.5.1-26.el9_6); before 0:1.5.1-25.el9_6 (fixed in 0:1.5.1-25.el9_6)
Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:1.5.1-9.el9_0.2 (fixed in 0:1.5.1-9.el9_0.2)
Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:1.5.1-15.el9_2.1 (fixed in 0:1.5.1-15.el9_2.1)
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support: before 0:1.5.1-24.el9_4 (fixed in 0:1.5.1-24.el9_4)
Red Hat Red Hat Insights Proxy 1.5: before 1.5.7-1759331989 (fixed in 1.5.7-1759331989)
Red Hat Red Hat Openshift Distributed Tracing 3.6.0
Red Hat Red Hat Openshift Sandboxed Containers 1.10: before 1.10.2-1757422110 (fixed in 1.10.2-1757422110); before 1.10.2-1757421804 (fixed in 1.10.2-1757421804); before 1.10.2-1757421879 (fixed in 1.10.2-1757421879); before 1.10.2-1757422401 (fixed in 1.10.2-1757422401)
Red Hat Red Hat Web Terminal 1.11 On Rhel 9: before 1.11-19 (fixed in 1.11-19); before 1.11-8 (fixed in 1.11-8)
Red Hat Red Hat Web Terminal 1.12 On Rhel 9: before 1.12-4 (fixed in 1.12-4)
Red Hat Rhel-8 Based Middleware Containers: before 7.13.5-4.1752066672 (fixed in 7.13.5-4.1752066672); before 7.13.5-4.1752065732 (fixed in 7.13.5-4.1752065732); before 7.13.5-3.1752065737 (fixed in 7.13.5-3.1752065737); before 7.13.5-4.1752065731 (fixed in 7.13.5-4.1752065731); before 7.13.5-25 (fixed in 7.13.5-25); before 7.13.5-4.1752065736 (fixed in 7.13.5-4.1752065736); …
Red Hat Rhoss-1.36-Rhel-8: before 1.36.0-11 (fixed in 1.36.0-11); before 1.36.0-10 (fixed in 1.36.0-10); before 1.36.0-4 (fixed in 1.36.0-4); before 1.36.0-9 (fixed in 1.36.0-9); before 1.36.0-12 (fixed in 1.36.0-12); before 1.36.0-18 (fixed in 1.36.0-18); …
and 11 more

Published 2025-06-17. Last modified 2026-10-07.