Bug#1107919: pam: CVE-2025-6020: pam_namespace: potential privilege escalation

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1107919: pam: CVE-2025-6020: pam_namespace: potential privilege escalation
Date	2025-06-17 12:40 +0200
Message-ID	<KYBTr-baWS-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: pam
Version: 1.7.0-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.5.2-6+deb12u1
Control: found -1 1.5.2-6

Hi,

The following vulnerability was published for pam.

CVE-2025-6020[0]:
| pam_namespace: potential privilege escalation


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-6020
    https://www.cve.org/CVERecord?id=CVE-2025-6020
[1] https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx
[2] https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e
    https://github.com/linux-pam/linux-pam/commit/592d84e1265d04c3104acee815a503856db503a1
    https://github.com/linux-pam/linux-pam/commit/976c20079358d133514568fc7fd95c02df8b5773

Please adjust the affected versions in the BTS as needed.

I would say to focus first on unstable -> trixie then we can have a
further look at bookworm.

Regards,
Salvatore

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1107919: pam: CVE-2025-6020: pam_namespace: potential privilege escalation Salvatore Bonaccorso <carnil@debian.org> - 2025-06-17 12:40 +0200
  Processed: pam: CVE-2025-6020: pam_namespace: potential privilege  escalation "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-06-17 12:40 +0200
  Bug#1107919: marked as done (pam: CVE-2025-6020: pam_namespace:  potential privilege escalation) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-06-26 20:10 +0200
  Bug#1107919: marked as done (pam: CVE-2025-6020: pam_namespace:  potential privilege escalation) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-06-29 20:10 +0200

csiph-web