CVE-2021-3551 Information disclosure in pki-server

High 7.8 Published 16 Feb 2022 Updated 3 Aug 2024

Local attackers can read admin credentials from debug logs in PKI-server, leading to privilege escalation and unauthorized access to the CA manager.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-3551?

CVE-2021-3551 is a high-severity vulnerability in Fedoraproject Fedora, published on 16 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Weakness: CWE-312

Which versions are affected by CVE-2021-3551?

It affects 12 products.

Linux distribution packages (25)

`jss` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.8.1-2.module+el8.4.0+10451+3e5b5448`
`jss-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.8.1-2.module+el8.4.0+10451+3e5b5448`
`jss-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.8.1-2.module+el8.4.0+10451+3e5b5448`
`jss-javadoc` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.8.1-2.module+el8.4.0+10451+3e5b5448`
`ldapjdk` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.22.0-1.module+el8.3.0+6784+6e1e4c62`
`ldapjdk-javadoc` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.22.0-1.module+el8.3.0+6784+6e1e4c62`
`pki-acme` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-base` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-base-java` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-ca` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-core` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-core-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-core-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-kra` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-server` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-symkey` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-symkey-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-tools` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`pki-tools-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`python3-pki` Red Hat:enterprise_linux:8::appstream	All versions	`0:10.10.5-3.module+el8.4.0+11039+635979e4`
`tomcatjss` Red Hat:enterprise_linux:8::appstream	All versions	`0:7.6.1-1.module+el8.4.0+8778+d07929ff`
`jss` Rocky Linux:8	All versions	`0:4.8.1-2.module+el8.4.0+418+b7ae1d4a`
`ldapjdk` Rocky Linux:8	All versions	`0:4.22.0-1.module+el8.4.0+418+b7ae1d4a`
`pki-core` Rocky Linux:8	All versions	`0:10.10.5-3.module+el8.4.0+554+92b527a1`
`tomcatjss` Rocky Linux:8	All versions	`0:7.6.1-1.module+el8.4.0+418+b7ae1d4a`

Products include Dogtagpki Dogtagpki, Fedoraproject Fedora, Oracle Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Ibm Z Systems and 6 more.

How do I fix CVE-2021-3551?

Apply the vendor's patch.

Is CVE-2021-3551 being exploited?

There is no known exploitation of CVE-2021-3551 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-3551, GHSA-9ggg-37fj-xc96, RHSA-2021:2235, RLSA-2021:2235, UBUNTU-CVE-2021-3551.