What’s Vulnerable › Vulnerabilities

CVE-2021-3551

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-16 · updated 2026-06-17
• Weakness: CWE-312

Description

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Affected products

• Dogtag PKI: from 10.10.0 before 10.10.6 — fixed in 10.10.6
• Fedoraproject Fedora: 33, 34
• Oracle Corporation Oracle Linux: 8
• Red Hat Enterprise Linux: 8.0
• RedHat Enterprise Linux Eus: 8.4
• RedHat Enterprise Linux For Ibm Z Systems: 8.0
• RedHat Enterprise Linux For Ibm Z Systems Eus: 8.4
• RedHat Enterprise Linux For Power Little Endian: 8.0
• RedHat Enterprise Linux For Power Little Endian Eus: 8.4
• RedHat Enterprise Linux Server Aus: 8.4
• RedHat Enterprise Linux Server Tus: 8.4
• RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.4

How to fix

Upgrade to a fixed version: Dogtag PKI 10.10.6. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1959971
• https://bugzilla.redhat.com/show_bug.cgi?id=1959971

Get alerted when CVE-2021-3551 or the next vulnerability affects your stack