Vulnerability · Published Feb 16, 2022 · Assigned by redhat
CVE-2021-3551
High 7.8
In plain English
A high-severity security flaw in pki-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.2%top 91.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux:8 | jss | 0:4.8.1-2.module+el8.4.0+418+b7ae1d4a | RLSA-2021:2235 |
| Rocky Linux:8 | ldapjdk | 0:4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2021:2235 |
| Rocky Linux:8 | pki-core | 0:10.10.5-3.module+el8.4.0+554+92b527a1 | RLSA-2021:2235 |
| Rocky Linux:8 | tomcatjss | 0:7.6.1-1.module+el8.4.0+418+b7ae1d4a | RLSA-2021:2235 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | pki-server | pki-core 10.10.6 |
Weakness: CWE-312
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1959971 x_refsource_MISC