Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2021-3551: Dogtag CA Manager: Debug Mode Exposes Admin Credentials
CVE-2021-3551 · published 4 years ago
Summary
If an attacker is on the same machine as the Dogtag CA manager, they can gain admin access to the system by getting the admin password from the installation log file. This is a serious risk because it allows unauthorized access to sensitive information. To fix this, disable debug mode or remove the log files after installation.
What to do
- Update dogtagpki dogtagpki to version 10.10.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | dogtag-pki | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | dogtag-pki | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | dogtag-pki | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | dogtag-pki | All versions |
| – | dogtagpki | dogtagpki |
>= 10.10.0, < 10.10.6 cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
33 34 cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| – | oracle | linux |
8 cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
8.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_eus |
8.4 cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_for_ibm_z_systems |
8.0 cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_for_ibm_z_systems_eus |
8.4 cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_for_power_little_endian |
8.0 cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_for_power_little_endian_eus |
8.4 cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_aus |
8.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_tus |
8.4 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_update_services_for_sap_solutions |
8.4 cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
Original advisory text
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the fil...
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
References
- https://ubuntu.com/security/CVE-2021-3551 Third Party Advisory
- https://rhn.redhat.com/errata/RHSA-2021-2235.html Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3551 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1959971 Issue Tracking Patch Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published16 Feb 2022
Updated30 Oct 2026
First seen13 Apr 2026
Track software like this
Free during beta