A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcatjssUpgrade pki-toolsUpgrade pki-acmeUpgrade jssUpgrade python3-pkiUpgrade pki-kraUpgrade pki-serverUpgrade jss-javadocUpgrade pki-baseUpgrade pki-base-javaUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade pki-symkeyUpgrade pki-ca | May 4, 2022 | Feb 16, 2022 |
| Centos_linux | — | Upgrade ldapjdkUpgrade jss-javadocUpgrade ldapjdk-javadocUpgrade pki-kraUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-tools-debuginfoUpgrade pki-serverUpgrade tomcatjssUpgrade python3-pkiUpgrade pki-symkey-debuginfoUpgrade pki-core-debugsourceUpgrade jssUpgrade jss-debuginfoUpgrade pki-caUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-acmeUpgrade jss-debugsource | Jun 4, 2021 | Jun 3, 2021 |
| Debian | — | No solution exists | May 15, 2025 | Feb 16, 2022 |
| Oracle_linux | — | Upgrade pki-toolsUpgrade pki-symkeyUpgrade pki-caUpgrade jssUpgrade pki-acmeUpgrade jss-javadocUpgrade pki-baseUpgrade ldapjdk-javadocUpgrade ldapjdkUpgrade pki-base-javaUpgrade python3-pkiUpgrade pki-kraUpgrade pki-serverUpgrade tomcatjss | Jun 5, 2021 | Jun 3, 2021 |
| Redhat_linux | — | Upgrade ldapjdkUpgrade tomcatjssUpgrade pki-core-debugsourceUpgrade pki-tools-debuginfoUpgrade pki-kraUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade python3-pkiUpgrade pki-base-javaUpgrade pki-symkey-debuginfoUpgrade pki-baseUpgrade jss-debugsourceUpgrade jssUpgrade pki-caUpgrade jss-debuginfoUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-acmeUpgrade pki-symkey | Jun 4, 2021 | Jun 3, 2021 |
| Rocky_linux | — | Upgrade jssUpgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade jss-debuginfoUpgrade pki-tools-debuginfoUpgrade jss-javadocUpgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade pki-core-debuginfoUpgrade pki-tools | May 5, 2022 | Feb 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub