rhsa-2025:21885
Vulnerability from csaf_redhat
Published
2025-11-20 19:56
Modified
2025-11-21 07:38
Summary
Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update
Notes
Topic
An updated OpenShift Compliance Operator image that fixes various bugs and adds new
enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.
Details
The OpenShift Compliance Operator v1.8.0 is now available.
See the documentation for bug fix information:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated OpenShift Compliance Operator image that fixes various bugs and adds new\nenhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenShift Compliance Operator v1.8.0 is now available.\nSee the documentation for bug fix information:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:21885",
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12085",
"url": "https://access.redhat.com/security/cve/CVE-2024-12085"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-5914",
"url": "https://access.redhat.com/security/cve/CVE-2025-5914"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-6020",
"url": "https://access.redhat.com/security/cve/CVE-2025-6020"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-6965",
"url": "https://access.redhat.com/security/cve/CVE-2025-6965"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-7195",
"url": "https://access.redhat.com/security/cve/CVE-2025-7195"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-7425",
"url": "https://access.redhat.com/security/cve/CVE-2025-7425"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-8941",
"url": "https://access.redhat.com/security/cve/CVE-2025-8941"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21885.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update",
"tracking": {
"current_release_date": "2025-11-21T07:38:12+00:00",
"generator": {
"date": "2025-11-21T07:38:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2025:21885",
"initial_release_date": "2025-11-20T19:56:52+00:00",
"revision_history": [
{
"date": "2025-11-20T19:56:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-11-20T19:57:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T07:38:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Compliance Operator 1",
"product": {
"name": "Compliance Operator 1",
"product_id": "Compliance Operator 1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_compliance_operator:1::el9"
}
}
}
],
"category": "product_family",
"name": "Compliance Operator"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-operator-bundle@sha256%3A0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52?arch=amd64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712?arch=amd64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e?arch=amd64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3Ac953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628?arch=amd64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3A9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520?arch=amd64\u0026repository_url=registry.redhat.io/compliance"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779?arch=arm64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676?arch=arm64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049?arch=arm64\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3A525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83?arch=arm64\u0026repository_url=registry.redhat.io/compliance"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3Ab282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3A0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3Ad051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89?arch=s390x\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498?arch=s390x\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779?arch=s390x\u0026repository_url=registry.redhat.io/compliance"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3A296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf?arch=s390x\u0026repository_url=registry.redhat.io/compliance"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"relates_to_product_reference": "Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64 as a component of Compliance Operator 1",
"product_id": "Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64",
"relates_to_product_reference": "Compliance Operator 1"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Pedro Gallegos",
"Simon Scannell",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12085",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2024-12-05T12:06:36.594000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Info Leak via Uninitialized Stack Contents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact as it helps bypass Address Space Layout Randomization (ASLR). ASLR is a memory protection system which makes the exploitation of memory corruption vulnerabilities more difficult.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12085"
},
{
"category": "external",
"summary": "RHBZ#2330539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12085",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12085"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12085",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12085"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "workaround",
"details": "Seeing as this vulnerability relies on information leakage coming from the presence of data in the uninitialized memory of the `sum2` buffer, a potential mitigation involves compiling rsync with the `-ftrivial-auto-var-init=zero` option set. This mitigates the issue because it initializes the `sum2` variable\u0027s memory with zeroes to prevent uninitialized memory disclosure.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: Info Leak via Uninitialized Stack Contents"
},
{
"cve": "CVE-2025-5914",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2025-06-06T17:58:25.491000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2370861"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has rated this vulnerability as Important because it allows a local attacker with limited privileges to trigger a double-free in libarchive\u0027s RAR parser by providing a specially crafted RAR archive. Successful exploitation could result in code execution or application crashes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-5914"
},
{
"category": "external",
"summary": "RHBZ#2370861",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-5914",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5914"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5914",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5914"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2598",
"url": "https://github.com/libarchive/libarchive/pull/2598"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0",
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
}
],
"release_date": "2025-05-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c"
},
{
"acknowledgments": [
{
"names": [
"Olivier BAL-PETRE"
],
"organization": "ANSSI - French Cybersecurity Agency"
}
],
"cve": "CVE-2025-6020",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2025-06-12T16:33:01.214000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372512"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "linux-pam: Linux-pam directory Traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in pam_namespace marked as Important rather than Moderate due to its direct impact on privilege boundaries and the ease of exploitation in common configurations. By leveraging symlink attacks or race conditions in polyinstantiated directories under their control, unprivileged local users can escalate to root, compromising the entire system. Since pam_namespace is often used in multi-user environments (e.g., shared systems, terminal servers, containers), a misconfigured or partially protected setup becomes a single point of failure. The attack does not require special capabilities or kernel-level exploits\u2014just timing and control over certain paths\u2014making it both reliable and low-barrier. Moreover, privilege escalation flaws like this can be chained with other vulnerabilities to persist or evade detection, further amplifying the risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6020"
},
{
"category": "external",
"summary": "RHBZ#2372512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372512"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6020",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6020"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6020",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6020"
}
],
"release_date": "2025-06-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "workaround",
"details": "Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "linux-pam: Linux-pam directory Traversal"
},
{
"cve": "CVE-2025-6965",
"cwe": {
"id": "CWE-197",
"name": "Numeric Truncation Error"
},
"discovery_date": "2025-07-15T14:02:19.241458+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2380149"
}
],
"notes": [
{
"category": "description",
"text": "A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: Integer Truncation in SQLite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in SQLite is categorized as Important rather than Critical because, although it involves memory corruption, the conditions required to trigger it are relatively constrained. The flaw arises when a query causes the number of aggregate terms to exceed internal limits, leading to potential buffer overflows or memory mismanagement. However, exploitation requires the ability to craft complex SQL queries and interact with the SQLite engine in a specific manner\u2014typically through direct SQL input. There is no known evidence of arbitrary code execution, privilege escalation, or remote exploitability as a direct result of this flaw. Additionally, most SQLite deployments are embedded in applications where input is tightly controlled or sanitized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6965"
},
{
"category": "external",
"summary": "RHBZ#2380149",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
},
{
"category": "external",
"summary": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8",
"url": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
}
],
"release_date": "2025-07-15T13:44:00.784000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: Integer Truncation in SQLite"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale",
"James Force"
]
}
],
"cve": "CVE-2025-7195",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"discovery_date": "2025-07-04T08:54:01.878000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2376300"
}
],
"notes": [
{
"category": "description",
"text": "Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. \n\nIn affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as low severity for affected products which run on OpenShift. The vulnerability allows for potential privilege escalation within a container, but OpenShift\u0027s default, multi-layered security posture effectively mitigates this risk. \n\nThe primary controls include the default Security Context Constraints (SCC), which severely limit a container\u0027s permissions from the start, and SELinux, which enforces mandatory access control to ensure strict isolation. While other container runtime environments may have different controls available and require case-by-case analysis, OpenShift\u0027s built-in defenses are designed to prevent this type of attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-7195"
},
{
"category": "external",
"summary": "RHBZ#2376300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-7195",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7195"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-7195",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7195"
}
],
"release_date": "2025-08-07T18:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "workaround",
"details": "In Red Hat OpenShift Container Platform, the following default configurations reduce the impact of this vulnerability.\n\nSecurity Context Constraints (SCCs): The default SCC, Restricted-v2, applies several crucial security settings to containers. \n\nCapabilities: drop: ALL removes all Linux capabilities, including SETUID and SETGID. This prevents a process from changing its user or group ID, a common step in privilege escalation attacks. The SETUID and SETGID capabilities can also be dropped explicitly if other capabilities are still required.\n\nallowPrivilegeEscalation: false ensures that a process cannot gain more privileges than its parent process. This blocks attempts by a compromised container process to grant itself additional capabilities.\n\nSELinux Mandatory Access Control (MAC): Pods are required to run with a pre-allocated Multi-Category Security (MCS) label. This SELinux feature provides a strong layer of isolation between containers and from the host system. A properly configured SELinux policy can prevent a container escape, even if an attacker gains elevated permissions within the container itself.\n\nFilesystem Hardening: While not a default setting, a common security practice is to set readOnlyRootFilesystem: true in a container\u0027s security context. In this specific scenario, this configuration would prevent an attacker from modifying critical files like /etc/passwd, even if they managed to gain file-level write permissions.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd"
},
{
"acknowledgments": [
{
"names": [
"Sergei Glazunov"
],
"organization": "Google Project Zero"
}
],
"cve": "CVE-2025-7425",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-07-10T09:37:28.172000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2379274"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This heap-use-after-free vulnerability in libxslt is rated Important because it can lead to memory corruption and application crashes. The flaw arises when internal attribute metadata (atype) is modified by libxslt\u0027s xsltSetSourceNodeFlags() function during processing of result tree fragments. If the flag corruption prevents proper removal of ID references, later memory cleanup routines may operate on already-freed memory. Since libxslt is commonly used in server-side XML processing, this could result in denial-of-service or potentially facilitate code execution under certain memory reuse conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-7425"
},
{
"category": "external",
"summary": "RHBZ#2379274",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379274"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-7425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-7425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7425"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/140",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/140"
}
],
"release_date": "2025-07-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxslt: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr"
},
{
"cve": "CVE-2025-8941",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2025-08-13T12:11:55.270000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2388220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a \"complete\" fix for CVE-2025-6020.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "linux-pam: Incomplete fix for CVE-2025-6020",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in pam_namespace is rated Important because it allows a local, unprivileged user to escalate privileges to root by exploiting symlink attacks or race conditions in polyinstantiated directories under their control. Successful exploitation requires only the ability to create and manipulate filesystem paths in such directories, without the need for special capabilities or kernel-level vulnerabilities. In multi-user environments\u2014such as shared systems, terminal servers, or certain container deployments, an unprotected or misconfigured pam_namespace configuration can serve as a single point of compromise. Privilege escalation flaws of this nature may also be chained with other vulnerabilities to maintain persistence or evade detection, further increasing the overall impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64"
],
"known_not_affected": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-8941"
},
{
"category": "external",
"summary": "RHBZ#2388220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-8941",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8941"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-8941",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8941"
}
],
"release_date": "2025-08-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-11-20T19:56:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:21885"
},
{
"category": "workaround",
"details": "Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`.",
"product_ids": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0642196267bef5bc68c20a5ee4d35c5dd139fbb00a905578a85cab5e220f445a_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:79554e96e4780fe3c219058a2d6408aa08dda31de091b7b7a647ed5f939e4712_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:7dfec9fbabaa748bbd91732ca5beebbd773306d5227a4f23af8fb0e444f0a779_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:d051f621dbcf4ec798b3782b8a49187852d1e352fd956131491288e36366dd89_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:4953a7ea865ff38a4fe19d5536d8062870c262733c640a2c7e4bd9e0bfb3d498_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6ab41bd207ae7e33f29adc87e208366472654bb5fb9b1854234cc5674ecc169e_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:9131ef184c616ec8a2aee2781dfe0c083463a9bfbdfaf59028bd5f626a9eb676_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b282ae2e5cfe451081785f221137d45d05320cf0017c3f1cba18a509d43eb6d9_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:06ad8599c4b0170264e40a45b0126504c87c37f0832265c7ff6541d2385b2049_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:09f37fa618a4e02460b28b1097148573b395354300db5f917ed155ab7968b779_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:8294e4b1b531457282270c375f4045ea2baf20a0a8a637006364096a9dec3c41_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:c953e9f9abf9cf25bf65bb3ffdc86ccf49b3e69a1cf3fbb47b6972e421fd6628_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:0bc0b7a20ce3c6303a45a699f44d2b90597b6a62846e89a5bca285b3228a9a52_amd64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:0903a7a5c857d96c84fd022e5785514eff201047e2fdd5d6699d79f17440ef02_ppc64le",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:296761e66fbac8934c137df3e0f0027e823b5db5a32eddf24f97489e24f4b8bf_s390x",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:525c4d55fde92557bd0c3123961cb32eee28edca3aaa884e224d5efa4f3c4f83_arm64",
"Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:9bc1fca7173d0080640ff9900d362512e480012a616922f4763e8e6becd8f520_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "linux-pam: Incomplete fix for CVE-2025-6020"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…