{"id":"CVE-2021-3551","aliases":["DEBIAN-CVE-2021-3551","EUVD-2021-26862","GHSA-9ggg-37fj-xc96","RHSA-2021:2235","RLSA-2021:2235","UBUNTU-CVE-2021-3551"],"status":"published","title":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores...","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00186,"percentile":0.08276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-312"],"published":"2021-06-03T07:53:39Z","modified":"2026-10-24T10:30:36Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss","fixed_in":["0:4.8.1-2.module+el8.4.0+10451+3e5b5448"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss-debuginfo","fixed_in":["0:4.8.1-2.module+el8.4.0+10451+3e5b5448"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss-debugsource","fixed_in":["0:4.8.1-2.module+el8.4.0+10451+3e5b5448"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss-javadoc","fixed_in":["0:4.8.1-2.module+el8.4.0+10451+3e5b5448"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ldapjdk","fixed_in":["0:4.22.0-1.module+el8.3.0+6784+6e1e4c62"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ldapjdk-javadoc","fixed_in":["0:4.22.0-1.module+el8.3.0+6784+6e1e4c62"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-acme","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-base","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-base-java","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-ca","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-core","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-core-debuginfo","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-core-debugsource","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-kra","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-server","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-symkey","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-symkey-debuginfo","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-tools","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-tools-debuginfo","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pki","fixed_in":["0:10.10.5-3.module+el8.4.0+11039+635979e4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcatjss","fixed_in":["0:7.6.1-1.module+el8.4.0+8778+d07929ff"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"jss","fixed_in":["0:4.8.1-2.module+el8.4.0+418+b7ae1d4a"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"ldapjdk","fixed_in":["0:4.22.0-1.module+el8.4.0+418+b7ae1d4a"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pki-core","fixed_in":["0:10.10.5-3.module+el8.4.0+554+92b527a1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"tomcatjss","fixed_in":["0:7.6.1-1.module+el8.4.0+418+b7ae1d4a"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3","10.10.6-1","11.0.0-1","11.0.3-1","11.0.3-2","11.0.3-3","11.0.3-4","11.0.6-1","11.0.6-2","11.2.1-1","11.2.1-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1-2.module+el8.4.0+10451+3e5b5448"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1-2.module+el8.4.0+10451+3e5b5448"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1-2.module+el8.4.0+10451+3e5b5448"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1-2.module+el8.4.0+10451+3e5b5448"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ldapjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-1.module+el8.3.0+6784+6e1e4c62"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ldapjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-1.module+el8.3.0+6784+6e1e4c62"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-base-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-core-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-symkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-symkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pki-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+11039+635979e4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcatjss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.6.1-1.module+el8.4.0+8778+d07929ff"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.1-2.module+el8.4.0+418+b7ae1d4a"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ldapjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.22.0-1.module+el8.4.0+418+b7ae1d4a"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pki-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.10.5-3.module+el8.4.0+554+92b527a1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcatjss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.6.1-1.module+el8.4.0+418+b7ae1d4a"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.6-1","10.2.6-2","10.2.6-3","10.2.6+git20160317-1","10.2.6+git20160317-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.3.5+12-4ubuntu1","10.3.5+12-5","10.5.3-3","10.5.3-4","10.5.5-1","10.6.0~beta2-3","10.6.0-1ubuntu1","10.6.0-1ubuntu2","10.6.0-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.7.3-4","10.8.3-1ubuntu1","10.8.3-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.10.2-3build1","11.0.0-1","11.0.0-1ubuntu0.1~esm1"]}],"products":[{"vendor":"dogtagpki","product":"dogtagpki"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"linux"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_server_update_services_for_sap_solutions"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959971","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3551","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9ggg-37fj-xc96"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3551","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3551","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:2235","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3551","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2021-2235.html","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3551","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-16T16:37:57Z","modified":"2024-08-03T17:01:06.563Z","cwes":["CWE-312"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26862","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-16T16:37:57Z","modified":"2024-08-03T17:01:06Z","updated_at":"2026-11-03T03:25:12.535968Z"}],"ghsa":[{"id":"GHSA-9ggg-37fj-xc96","title":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores...","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-17T00:00:31Z","modified":"2023-02-03T05:06:06Z","cwes":["CWE-312"],"updated_at":"2026-11-02T14:53:50.761362Z"}],"nvd":[{"id":"CVE-2021-3551","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-16T17:15:11.103Z","modified":"2026-06-17T04:05:19.96Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"CVE-2021-3551","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-16T17:15:11.103Z","modified":"2026-10-24T10:30:36.804505956Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-3551","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-16T17:15:11.103Z","modified":"2026-08-27T23:04:04.574626835Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2021:2235","title":"Red Hat Security Advisory: pki-core:10.6 security update","status":"published","published":"2024-09-16T05:56:04Z","modified":"2025-11-22T12:21:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:2235","title":"Important: pki-core:10.6 security update","description":"The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.\n\nSecurity Fix(es):\n\n* pki-server: Dogtag installer \"pkispawn\" logs admin credentials into a world-readable log file (CVE-2021-3551)\n\nThe PKI installer \"pkispawn\" logs admin credentials into a\nworld-readable log file. It also looks like the installer is passing the\npassword as an insecure command line argument. The credentials are the\n389-DS LDAP server's Directory Manager credentials. The Directory\nManager is 389-DS' equivalent of unrestricted root account. The user\nbypasses permission checks and grants full access to data. In an IdM /\nFreeIPA installation the DM user is able to read and manipulate Kerberos\nKDC master password, Kerberos keytabs, hashed user passwords, and more.\nAny and all IdM and FreeIPA installations with PKI 10.10 should be\nconsidered compromised.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-06-03T07:53:39Z","modified":"2026-02-04T07:40:24.803838Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-3551","description":"A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-02-16T17:15:00Z","modified":"2026-04-13T10:55:44.299632Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"}]}}