A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-acmeUpgrade pki-toolsUpgrade tomcatjssUpgrade jssUpgrade python3-pkiUpgrade pki-kraUpgrade jss-javadocUpgrade pki-serverUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade pki-caUpgrade pki-baseUpgrade pki-base-java | May 4, 2022 | Feb 16, 2022 |
| Centos_linux | — | Upgrade pki-baseUpgrade ldapjdk-javadocUpgrade tomcatjssUpgrade python3-pkiUpgrade ldapjdkUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-symkey-debuginfoUpgrade pki-core-debugsourceUpgrade jss-javadocUpgrade pki-kraUpgrade pki-tools-debuginfoUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade pki-acmeUpgrade jss-debuginfoUpgrade pki-symkeyUpgrade pki-caUpgrade jss-debugsourceUpgrade jss | Jun 4, 2021 | Jun 3, 2021 |
| Debian | — | No solution exists | May 15, 2025 | Feb 16, 2022 |
| Oracle_linux | — | Upgrade python3-pkiUpgrade pki-kraUpgrade pki-baseUpgrade jss-javadocUpgrade ldapjdkUpgrade pki-serverUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade pki-toolsUpgrade jssUpgrade pki-symkeyUpgrade pki-caUpgrade pki-acme | Jun 5, 2021 | Jun 3, 2021 |
| Redhat_linux | — | Upgrade jss-debuginfoUpgrade pki-acmeUpgrade pki-toolsUpgrade pki-caUpgrade pki-symkeyUpgrade jssUpgrade pki-core-debuginfoUpgrade ldapjdkUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-symkey-debuginfoUpgrade jss-debugsourceUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade python3-pkiUpgrade jss-javadocUpgrade pki-kraUpgrade pki-tools-debuginfoUpgrade pki-core-debugsourceUpgrade pki-base | Jun 4, 2021 | Jun 3, 2021 |
| Rocky_linux | — | Upgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade jss-javadocUpgrade pki-symkey-debuginfoUpgrade jss-debuginfoUpgrade pki-tools-debuginfoUpgrade pki-symkeyUpgrade jss | May 5, 2022 | Feb 16, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub