CVE & CISA-KEV CatalogNVD
CVE-2025-58712
MEDIUM6.4
CVSS v3
Description
A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
How to fix
Remediation Available
amq7-tech-preview/amq-broker-consoleRed Hat / RHEL
Fixed in:plugin-rhel9@sha256:0c2b3d12e0c749b62659fd95781f17510e71abd8659d8e8e2e77b37e43297f6c_amd64RHSA-2025:17562
Fixed in:plugin-rhel9@sha256:8018dcfd760803867e3b5d7d52679343325e42fb9e7bd6286fbf3edcfaf3f721_arm64RHSA-2025:17562
Fixed in:plugin-rhel9@sha256:d165fa9eaa342e52b7ea9f17edff7a8b816acab21610ddedb34c0fd45c255004_s390xRHSA-2025:17562
Fixed in:plugin-rhel9@sha256:df06cfeedcc4d41d66a392a95cd103d4562b6a33f4ca665c35f310b099e61bc2_ppc64leRHSA-2025:17562
amq7-tech-preview/amq-broker-consoleRocky
Fixed in:plugin-rhel9@sha256:df06cfeedcc4d41d66a392a95cd103d4562b6a33f4ca665c35f310b099e61bc2_ppc64leRHSA-2025:17562
Fixed in:plugin-rhel9@sha256:8018dcfd760803867e3b5d7d52679343325e42fb9e7bd6286fbf3edcfaf3f721_arm64RHSA-2025:17562
Fixed in:plugin-rhel9@sha256:d165fa9eaa342e52b7ea9f17edff7a8b816acab21610ddedb34c0fd45c255004_s390xRHSA-2025:17562
Fixed in:plugin-rhel9@sha256:0c2b3d12e0c749b62659fd95781f17510e71abd8659d8e8e2e77b37e43297f6c_amd64RHSA-2025:17562
amq7-tech-preview/amq-broker-jolokia-apiRed Hat / RHEL
Fixed in:server-rhel9@sha256:e03e5adcfe23118c42cfe6eaa5de710128ebcd1188582c3d39cd2fd0f16af01e_ppc64leRHSA-2025:17562
Fixed in:server-rhel9@sha256:5bea712e835fa8531b0a2c25ebd89fbd43cb1efbf86361bd66886f6894ac8660_arm64RHSA-2025:17562
Fixed in:server-rhel9@sha256:860d4857f8f78e187700097f7e284881ebcd3cc546be5c5e10dbecf062fb0743_amd64RHSA-2025:17562
Fixed in:server-rhel9@sha256:03189040dfd46fb9d77821e82b6e476c827d435780fd5601a14a2fc427c62ac8_s390xRHSA-2025:17562
amq7-tech-preview/amq-broker-jolokia-apiRocky
Fixed in:server-rhel9@sha256:860d4857f8f78e187700097f7e284881ebcd3cc546be5c5e10dbecf062fb0743_amd64RHSA-2025:17562
Fixed in:server-rhel9@sha256:5bea712e835fa8531b0a2c25ebd89fbd43cb1efbf86361bd66886f6894ac8660_arm64RHSA-2025:17562
Fixed in:server-rhel9@sha256:03189040dfd46fb9d77821e82b6e476c827d435780fd5601a14a2fc427c62ac8_s390xRHSA-2025:17562
Fixed in:server-rhel9@sha256:e03e5adcfe23118c42cfe6eaa5de710128ebcd1188582c3d39cd2fd0f16af01e_ppc64leRHSA-2025:17562
amq7/amqRocky
Fixed in:broker-rhel9@sha256:ea91a6449ec9b6311ed3ff1294212dd746dc64a040bb797b5fda42f4f29efcb5_amd64RHSA-2025:17562
Fixed in:broker-rhel9@sha256:9a3b7a41a2d0e7ab6a6f804d092f271feae675c39db3101f20318201360ca840_ppc64leRHSA-2025:17562
Fixed in:broker-rhel9@sha256:6ee2d7b346cf6c7fe9a3dd7846e0907bfe7241cd9b8139cf6eaeb0a8dbb0a427_s390xRHSA-2025:17562
Fixed in:broker-rhel9@sha256:9ab9abec5a6a22c5b8b893c03e5257c3362a8afeb93b6f171d411b35acd02d87_arm64RHSA-2025:17562
amq7/amqRed Hat / RHEL
Fixed in:broker-rhel9@sha256:6ee2d7b346cf6c7fe9a3dd7846e0907bfe7241cd9b8139cf6eaeb0a8dbb0a427_s390xRHSA-2025:17562
Fixed in:broker-rhel9@sha256:ea91a6449ec9b6311ed3ff1294212dd746dc64a040bb797b5fda42f4f29efcb5_amd64RHSA-2025:17562
Fixed in:broker-rhel9@sha256:9ab9abec5a6a22c5b8b893c03e5257c3362a8afeb93b6f171d411b35acd02d87_arm64RHSA-2025:17562
Fixed in:broker-rhel9@sha256:9a3b7a41a2d0e7ab6a6f804d092f271feae675c39db3101f20318201360ca840_ppc64leRHSA-2025:17562
amq7/amq-brokerRocky
Fixed in:init-rhel9@sha256:1855ee7290a6b7446e5adc64ca447cb5d3fb462fb11a0d01cb9b5ef67ad666bb_amd64RHSA-2025:17562
Fixed in:init-rhel9@sha256:725b875c9ca96582d691aef2220b14e22f75e6840b987f48bf1333f428cfa1f7_ppc64leRHSA-2025:17562
Fixed in:rhel9-operator@sha256:d3d35ae65371c65e84c93608d1dc4f1516e822d078d60a712c2bbb59a4350991_ppc64leRHSA-2025:17562
Fixed in:rhel9-operator@sha256:e06ad5a9fb69f76088bdd5ab5a4271ca62c78659fbffd9e7c632a8e5466cfd6b_amd64RHSA-2025:17562
Fixed in:init-rhel9@sha256:869954655497885a4567939746a1d044df1479321b4cac63ee93d629738124dc_arm64RHSA-2025:17562
Fixed in:rhel9-operator@sha256:3ae4080c838322980d13a5acb981c5584ec1512c7d59b7d6cee0bdc157682851_arm64RHSA-2025:17562
Fixed in:init-rhel9@sha256:341a80c596eb555d435d2489132cb89fe47e9a0e40f2045b5773a81889063946_s390xRHSA-2025:17562
Fixed in:rhel9-operator@sha256:98291e2f50cc6f2313096ab5b51dcaa1e0d3232236fa6d839cfe63fbeaec0cb5_s390xRHSA-2025:17562
amq7/amq-brokerRed Hat / RHEL
Fixed in:rhel9-operator@sha256:d3d35ae65371c65e84c93608d1dc4f1516e822d078d60a712c2bbb59a4350991_ppc64leRHSA-2025:17562
Fixed in:init-rhel9@sha256:1855ee7290a6b7446e5adc64ca447cb5d3fb462fb11a0d01cb9b5ef67ad666bb_amd64RHSA-2025:17562
Fixed in:rhel9-operator@sha256:e06ad5a9fb69f76088bdd5ab5a4271ca62c78659fbffd9e7c632a8e5466cfd6b_amd64RHSA-2025:17562
Fixed in:init-rhel9@sha256:869954655497885a4567939746a1d044df1479321b4cac63ee93d629738124dc_arm64RHSA-2025:17562
Fixed in:rhel9-operator@sha256:3ae4080c838322980d13a5acb981c5584ec1512c7d59b7d6cee0bdc157682851_arm64RHSA-2025:17562
Fixed in:init-rhel9@sha256:341a80c596eb555d435d2489132cb89fe47e9a0e40f2045b5773a81889063946_s390xRHSA-2025:17562
Fixed in:rhel9-operator@sha256:98291e2f50cc6f2313096ab5b51dcaa1e0d3232236fa6d839cfe63fbeaec0cb5_s390xRHSA-2025:17562
Fixed in:init-rhel9@sha256:725b875c9ca96582d691aef2220b14e22f75e6840b987f48bf1333f428cfa1f7_ppc64leRHSA-2025:17562
amq7/amq-broker-rhel9Red Hat / RHEL
Fixed in:operator-bundle@sha256:33f584255364b8f5cc7e37f14d7a257b4414716872323433374001df2eb47c7d_amd64RHSA-2025:17562
amq7/amq-broker-rhel9Rocky
Fixed in:operator-bundle@sha256:33f584255364b8f5cc7e37f14d7a257b4414716872323433374001df2eb47c7d_amd64RHSA-2025:17562
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorLocal
Attack ComplexityHigh
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploit Intelligence
0.19%probability of exploitation in 30 days
9thpercentile
Low risk: more likely to be exploited than 9% of all known CVEs.
References
Other references3
Related Vulnerabilities
Other CWE-276 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2013-0632 | Critical | 9.8 | 94% | KEV | - |
| CVE-2017-11610 | High | 8.8 | 88% | - | Fix |
| CVE-2023-29919 | Critical | 9.1 | 60% | - | - |
| CVE-2019-17124 | Critical | 9.8 | 23% | - | - |
| CVE-2020-12608 | High | 7.8 | 22% | - | Fix |
| CVE-2021-3437 | Critical | 9.8 | 16% | - | Fix |
Embed a live status badge for CVE-2025-58712
Markdown
[](https://tridentstack.com/cve/CVE-2025-58712)HTML
<a href="https://tridentstack.com/cve/CVE-2025-58712"><img src="https://tridentstack.com/cve/badge/CVE-2025-58712.svg" alt="CVE-2025-58712"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-03-07.