CVE-2021-3551
Fixed in a distro release EPSS <1%
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
Products: dogtagpki, fedoraproject fedora, oracle linux, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_for_ibm_z_systems, redhat enterprise_linux_for_ibm_z_systems_eus, redhat enterprise_linux_for_power_little_endian, redhat enterprise_linux_for_power_little_endian_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_server_update_services_for_sap_solutions
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | dogtag-pki | no fix |
| Red Hat Enterprise Linux 8 | jss | 0:4.8.1-2.module+el8.4.0+10451+3e5b5448 |
| Red Hat Enterprise Linux 8 | jss-debuginfo | 0:4.8.1-2.module+el8.4.0+10451+3e5b5448 |
| Red Hat Enterprise Linux 8 | jss-debugsource | 0:4.8.1-2.module+el8.4.0+10451+3e5b5448 |
| Red Hat Enterprise Linux 8 | jss-javadoc | 0:4.8.1-2.module+el8.4.0+10451+3e5b5448 |
| Red Hat Enterprise Linux 8 | ldapjdk | 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62 |
| Red Hat Enterprise Linux 8 | ldapjdk-javadoc | 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62 |
| Red Hat Enterprise Linux 8 | pki-acme | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-base | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-base-java | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-ca | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-core | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-core-debuginfo | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-core-debugsource | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-kra | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-server | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-symkey | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-symkey-debuginfo | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-tools | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | pki-tools-debuginfo | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | python3-pki | 0:10.10.5-3.module+el8.4.0+11039+635979e4 |
| Red Hat Enterprise Linux 8 | tomcatjss | 0:7.6.1-1.module+el8.4.0+8778+d07929ff |
| Rocky Linux 8 | jss | 0:4.8.1-2.module+el8.4.0+418+b7ae1d4a |
| Rocky Linux 8 | ldapjdk | 0:4.22.0-1.module+el8.4.0+418+b7ae1d4a |
| Rocky Linux 8 | pki-core | 0:10.10.5-3.module+el8.4.0+554+92b527a1 |
| Rocky Linux 8 | tomcatjss | 0:7.6.1-1.module+el8.4.0+418+b7ae1d4a |
| Ubuntu Pro 16.04 LTS | dogtag-pki | no fix |
| Ubuntu Pro 18.04 LTS | dogtag-pki | no fix |
| Ubuntu Pro 20.04 LTS | dogtag-pki | no fix |
| Ubuntu Pro 22.04 LTS | dogtag-pki | no fix |