CVE-2021-3551

Name	CVE-2021-3551
Description	A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	991665

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dogtag-pki (PTS)	bullseye	10.10.2-3	vulnerable
	sid	11.2.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dogtag-pki	source	(unstable)	10.10.6-1			991665

Notes

[bullseye] - dogtag-pki <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=1959971
https://github.com/dogtagpki/pki/commit/0c2f3b84499584bb6029f5ba3988ed3cb081e548
https://github.com/dogtagpki/pki/commit/b01cd8cc7d3e391e69ed2c8161f7e15fa84553e6
https://github.com/dogtagpki/pki/commit/5b09fcaff11d33010469e695ef365a91c91674b5