Monthly GLSA metadata 2025-07-01

[flatcar-infra]

Updated GLSA metadata

[dongsupark]

This PR is blocked by pam update, 202505-01, which points to CVE-2024-10041, only CVSS 4.7, and CVE-2024-22365, CVSS 5.5. Both are already handled by an open issue flatcar/Flatcar#1349.
I am not sure if the former issue would be a valid issue for Flatcar, because the possible impact would be password leaks. At least not that red flag to be blocked by GLSA. On the other hand, the latter issue seems to be a valid issue for Flatcar.
In any case, I would not call any of them a GLSA issue.

If GLSA would try to address the 2 other issues, CVE-2024-10963, CVSS 7.4, CVE-2025-6020, CVSS 7.8, then I could understand. However, that is also not the case. So I do not quite understand reasoning from upstream.

Anyway, as discussed in flatcar/Flatcar#1349, we are going to anyway update pam soon.

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/15996551767