Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.rc > #393096 > unrolled thread
| Started by | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| First post | 2025-06-17 12:40 +0200 |
| Last post | 2025-06-29 20:10 +0200 |
| Articles | 4 — 2 participants |
Back to article view | Back to linux.debian.bugs.rc
Bug#1107919: pam: CVE-2025-6020: pam_namespace: potential privilege escalation Salvatore Bonaccorso <carnil@debian.org> - 2025-06-17 12:40 +0200
Processed: pam: CVE-2025-6020: pam_namespace: potential privilege escalation "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-06-17 12:40 +0200
Bug#1107919: marked as done (pam: CVE-2025-6020: pam_namespace: potential privilege escalation) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-06-26 20:10 +0200
Bug#1107919: marked as done (pam: CVE-2025-6020: pam_namespace: potential privilege escalation) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-06-29 20:10 +0200
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2025-06-17 12:40 +0200 |
| Subject | Bug#1107919: pam: CVE-2025-6020: pam_namespace: potential privilege escalation |
| Message-ID | <KYBTr-baWS-1@gated-at.bofh.it> |
Source: pam
Version: 1.7.0-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.5.2-6+deb12u1
Control: found -1 1.5.2-6
Hi,
The following vulnerability was published for pam.
CVE-2025-6020[0]:
| pam_namespace: potential privilege escalation
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-6020
https://www.cve.org/CVERecord?id=CVE-2025-6020
[1] https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx
[2] https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e
https://github.com/linux-pam/linux-pam/commit/592d84e1265d04c3104acee815a503856db503a1
https://github.com/linux-pam/linux-pam/commit/976c20079358d133514568fc7fd95c02df8b5773
Please adjust the affected versions in the BTS as needed.
I would say to focus first on unstable -> trixie then we can have a
further look at bookworm.
Regards,
Salvatore
[toc] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2025-06-17 12:40 +0200 |
| Subject | Processed: pam: CVE-2025-6020: pam_namespace: potential privilege escalation |
| Message-ID | <KYBTr-baWS-3@gated-at.bofh.it> |
| In reply to | #393096 |
Processing control commands: > found -1 1.5.2-6+deb12u1 Bug #1107919 [src:pam] pam: CVE-2025-6020: pam_namespace: potential privilege escalation Marked as found in versions pam/1.5.2-6+deb12u1. > found -1 1.5.2-6 Bug #1107919 [src:pam] pam: CVE-2025-6020: pam_namespace: potential privilege escalation Marked as found in versions pam/1.5.2-6. -- 1107919: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107919 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2025-06-26 20:10 +0200 |
| Subject | Bug#1107919: marked as done (pam: CVE-2025-6020: pam_namespace: potential privilege escalation) |
| Message-ID | <L1ZcR-dmUd-15@gated-at.bofh.it> |
| In reply to | #393096 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Thu, 26 Jun 2025 18:04:24 +0000 with message-id <E1uUqxU-002soK-Qy@fasolo.debian.org> and subject line Bug#1107919: fixed in pam 1.7.0-4 has caused the Debian Bug report #1107919, regarding pam: CVE-2025-6020: pam_namespace: potential privilege escalation to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1107919: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107919 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2025-06-29 20:10 +0200 |
| Subject | Bug#1107919: marked as done (pam: CVE-2025-6020: pam_namespace: potential privilege escalation) |
| Message-ID | <L34Dv-e3In-5@gated-at.bofh.it> |
| In reply to | #393096 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Sun, 29 Jun 2025 18:04:28 +0000 with message-id <E1uVwOC-00HVck-1N@fasolo.debian.org> and subject line Bug#1107919: fixed in pam 1.7.0-5 has caused the Debian Bug report #1107919, regarding pam: CVE-2025-6020: pam_namespace: potential privilege escalation to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1107919: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107919 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.rc
csiph-web