Critical Security Update for pam: Addressing Directory Traversal Vulnerabilities
Summary
ALSA-2025:15099: Important: pam security update. Affects pam versions < 1.5.1-26.el9_6. Fixed in 1.5.1-26.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pluggable Authentication Modules (PAM) is a framework that enables the management of authentication policies for applications on Unix-like operating systems. It allows system administrators to configure authentication methods without modifying the applications themselves. PAM is widely used for managing user access and security, making it a critical component of system integrity. The recent vulnerabilities identified in PAM could potentially allow unauthorized access to sensitive system resources.
Vulnerability Detail
The vulnerabilities identified in PAM include a directory traversal issue (CVE-2025-6020) that could allow attackers to access files outside of intended directories. Additionally, an incomplete fix for this issue (CVE-2025-8941) has been reported, which may leave systems still vulnerable. These vulnerabilities can lead to unauthorized data exposure and compromise system security, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
1.5.1-26.el9_6
This is the first release that contains the fix.
sudo dnf update pamTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive directories and files until the update is applied. This can be done by modifying file permissions or using access control lists (ACLs) to limit user access.
Conclusion
The vulnerabilities identified in the PAM package pose significant risks to system security. It is crucial for users to update to the latest patched version to protect against unauthorized access. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for pam →
FAQ
The main vulnerabilities include a directory traversal issue (CVE-2025-6020) and an incomplete fix for this issue (CVE-2025-8941).
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to access the code.
These vulnerabilities could allow unauthorized access to sensitive files, potentially compromising system security and user data.
Yes, a patch is available in version 1.5.1-26.el9_6 of the PAM package. Users should update to this version to mitigate the vulnerabilities.
You can use Vulert to receive real-time alerts about vulnerabilities in your open-source dependencies, ensuring you are always informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for pam.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
