Every CVE Search/ Get API key

CVE-2021-3551

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores...

7.8 HighFix available

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.19%Down 0.7 points since Feb 17, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3551
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-312
Updated
2026-11-02
CVE List No score

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3551
Weakness
CWE-312
Updated
2026-11-02
EUVDEUVD-2021-26862 No score

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
EUVD-2021-26862
Updated
2026-11-03
GitHub AdvisoriesGHSA-9ggg-37fj-xc96 No score

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores...

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
GHSA-9ggg-37fj-xc96
Weakness
CWE-312
Updated
2026-11-02
OSV 7.8

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
CVE-2021-3551
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3551 7.8

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
DEBIAN-CVE-2021-3551
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:2235 8.8

Red Hat Security Advisory: pki-core:10.6 security update

Record
RHSA-2021:2235
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:2235 7.8

Important: pki-core:10.6 security update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

  • pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file (CVE-2021-3551)

The PKI installer "pkispawn" logs admin credentials into a world-readable log file. It also looks like the installer is passing the password as an insecure command line argument. The credentials are the 389-DS LDAP server's Directory Manager credentials. The Directory Manager is 389-DS' equivalent of unrestricted root account. The user bypasses permission checks and grants full access to data. In an IdM / FreeIPA installation the DM user is able to read and manipulate Kerberos KDC master password, Kerberos keytabs, hashed user passwords, and more. Any and all IdM and FreeIPA installations with PKI 10.10 should be considered compromised.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:2235
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3551 7.8

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Record
UBUNTU-CVE-2021-3551
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dogtag-pki
Debian:11
 All versions, plus listed versions
10.10.2-310.10.6-111.0.0-111.0.3-111.0.3-2
Show 6 moreShow less
11.0.3-311.0.3-411.0.6-111.0.6-211.2.1-111.2.1-2
 None known
jss
Red Hat:enterprise_linux:8::appstream
 before 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-javadoc
Red Hat:enterprise_linux:8::appstream
 before 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
0:4.8.1-2.module+el8.4.0+10451+3e5b5448
ldapjdk
Red Hat:enterprise_linux:8::appstream
 before 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
ldapjdk-javadoc
Red Hat:enterprise_linux:8::appstream
 before 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
pki-acme
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-base
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-base-java
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
Show 20 moreShow less
Affected packages
PackageAffectedFixed
pki-ca
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-core
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-core-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-core-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-kra
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-server
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-symkey
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-symkey-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-tools
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
pki-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
python3-pki
Red Hat:enterprise_linux:8::appstream
 before 0:10.10.5-3.module+el8.4.0+11039+635979e4
0:10.10.5-3.module+el8.4.0+11039+635979e4
tomcatjss
Red Hat:enterprise_linux:8::appstream
 before 0:7.6.1-1.module+el8.4.0+8778+d07929ff
0:7.6.1-1.module+el8.4.0+8778+d07929ff
jss
Rocky Linux:8
 before 0:4.8.1-2.module+el8.4.0+418+b7ae1d4a
0:4.8.1-2.module+el8.4.0+418+b7ae1d4a
ldapjdk
Rocky Linux:8
 before 0:4.22.0-1.module+el8.4.0+418+b7ae1d4a
0:4.22.0-1.module+el8.4.0+418+b7ae1d4a
pki-core
Rocky Linux:8
 before 0:10.10.5-3.module+el8.4.0+554+92b527a1
0:10.10.5-3.module+el8.4.0+554+92b527a1
tomcatjss
Rocky Linux:8
 before 0:7.6.1-1.module+el8.4.0+418+b7ae1d4a
0:7.6.1-1.module+el8.4.0+418+b7ae1d4a
dogtag-pki
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
10.2.6-110.2.6-210.2.6-310.2.6+git20160317-110.2.6+git20160317-1ubuntu0.1~esm1
 None known
dogtag-pki
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
10.3.5+12-4ubuntu110.3.5+12-510.5.3-310.5.3-410.5.5-1
Show 4 moreShow less
10.6.0~beta2-310.6.0-1ubuntu110.6.0-1ubuntu210.6.0-1ubuntu2+esm1
 None known
dogtag-pki
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
10.7.3-410.8.3-1ubuntu110.8.3-1ubuntu1+esm1
 None known
dogtag-pki
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
10.10.2-3build111.0.0-111.0.0-1ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3551 is a high vulnerability (CVSS 7.8) in Dogtagpki, published June 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in jss 0:4.8.1-2.module+el8.4.0+10451+3e5b5448.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open