Path Traversal in Red Hat Cert-Manager Operator For Openshift 1.16
CVE-2025-6020
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (37.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Red Hat Cert-Manager Operator For Openshift 1.16 — versions v1.16.5-1760515757, sha256:1abdfac084e7c86e7a93a19e5cf6b54db79b903bfb7474a42200f753b29eda4b
- Red Hat Compliance Operator 1 — versions 1.8.0
- Red Hat Openshift Compliance Operator 1 — versions 1.8.0, sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049
- Red Hat Discovery 2 — versions 2.0.0-1752592913, sha256:bd9cb502def3153c193713b56372694cb555a71b38d4fc0fd9d021bccc5602de, sha256:1c67d8d526ab4f2854947f7dccd8752a2efd414c0f1cbab17706fa91147e7cda
- Red Hat Enterprise Linux 10 — versions 0:1.6.1-8.el10
- Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:1.6.1-8.el10_0
- Red Hat Enterprise Linux 7 Extended Lifecycle Support — versions 0:1.1.8-23.el7_9.1
- Red Hat Enterprise Linux 8 — versions 0:1.3.1-37.el8_10, 0:1.3.1-38.el8_10
- Red Hat Enterprise Linux 8.2 Advanced Update Support — versions 0:1.3.1-8.el8_2.1
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 0:1.3.1-14.el8_4.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- access.redhat.com/errata/RHSA-2025:10024 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10027 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10180 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10354 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10357 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10358 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10359 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10361 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10362 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:10735 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-6020?
- CVE-2025-6020 is a high-severity vulnerability in Red Hat Cert-Manager Operator For Openshift 1.16, classified under Path Traversal. CVSS score: 7.8/10. Published 2025-06-17.
- How severe is CVE-2025-6020?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2025-6020 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.