Skip to content
Fencer Vulns
high 7.8

CVE-2021-3551 json

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log f…

published 2022-02-16 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26862

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

Patch / fix

  • dogtagpki dogtagpki 10.10.6
  • jss RHEL 8 4.8.1-2.module+el8.4.0+10451+3e5b5448
  • pki-ca RHEL 8 10.10.5-3.module+el8.4.0+11039+635979e4
  • ldapjdk RHEL 8 4.22.0-1.module+el8.3.0+6784+6e1e4c62
  • pki-kra RHEL 8 10.10.5-3.module+el8.4.0+11039+635979e4
  • pki-acme RHEL 8 10.10.5-3.module+el8.4.0+11039+635979e4
  • pki-base RHEL 8 10.10.5-3.module+el8.4.0+11039+635979e4
  • pki-core RHEL 8 10.10.5-3.module+el8.4.0+11039+635979e4
  • pki-tools RHEL 8 10.10.5-3.module+el8.4.0+11039+635979e4

red hat advisories RHSA-2021:2235

  • jss Rocky Linux 8 4.8.1-2.module+el8.4.0+418+b7ae1d4a
  • ldapjdk Rocky Linux 8 4.22.0-1.module+el8.4.0+418+b7ae1d4a
  • pki-core Rocky Linux 8 10.10.5-3.module+el8.4.0+554+92b527a1
  • tomcatjss Rocky Linux 8 7.6.1-1.module+el8.4.0+418+b7ae1d4a

rocky linux advisories RLSA-2021:2235

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3551 updated cvss 7.8

pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file

  • Red Hat Certificate System 10 pki-core
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) jss 4.8.1-2.module+el8.4.0+10451+3e5b5448, ldapjdk 4.22.0-1.module+el8.3.0+6784+6e1e4c62, pki-ca 10.10.5-3.module+el8.4.0+11039+635979e4, tomcatjss 7.6.1-1.module+el8.4.0+8778+d07929ff, pki-kra 10.10.5-3.module+el8.4.0+11039+635979e4, pki-acme 10.10.5-3.module+el8.4.0+11039+635979e4, +9 more
    fixed: vendor fix RHSA-2021:2235
  • Red Hat Enterprise Linux 6 pki-ca, pki-core, pki-util, pki-setup, pki-common, pki-silent, +7 more Red Hat Enterprise Linux 7 pki-ca, pki-kra, pki-base, pki-core, pki-tools, pki-server, +3 more Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +13 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • n/a pki-server

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.