Description
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pki-core | pki-core 10.5, pki-core 10.8, pki-core 10.9, pki-core 10.10, pki-core 10.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | dogtag-pki | 10.10.2-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | dogtag-pki | 10.8.3-1ubuntu1+esm1 | USN-8158-1 |
| Ubuntu Pro 18.04 LTS | dogtag-pki | 10.6.0-1ubuntu2+esm1 | USN-8158-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | jss +1 | 4.7.3-1.module+el8.3.0+8058+d5cd4219 | RHSA-2021:0966 |
| RHEL 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2021:0966 |
| RHEL 8 | pki-ca +8 | 10.9.4-3.module+el8.3.0+10353+73f6df5b | RHSA-2021:0966 |
| RHEL 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7355+c59bcbd9 | RHSA-2021:0966 |
| RHEL 7 | pki-ca +8 | 10.5.18-12.el7_9 | RHSA-2021:0851 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 EUS | jss +1 | 4.6.2-12.module+el8.2.0+10554+cf83aa72 | RHSA-2021:1263 |
| RHEL 8.2 EUS | ldapjdk +1 | 4.21.0-2.module+el8.2.0+6294+b7db4606 | RHSA-2021:1263 |
| RHEL 8.2 EUS | pki-ca +8 | 10.8.3-6.module+el8.2.0+10554+cf83aa72 | RHSA-2021:1263 |
| RHEL 8.2 EUS | tomcatjss | 7.4.1-2.module+el8.2.0+6294+b7db4606 | RHSA-2021:1263 |
| RHEL 7.7 EUS | pki-ca +8 | 10.5.16-7.el7_7 | RHSA-2021:0975 |
| RHEL 7.6 EUS | pki-ca +8 | 10.5.9-15.el7_6 | RHSA-2021:0819 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | ldapjdk | 4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2021:0966 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pki-ca +7 | 10.5.18-12.amzn2.0.1 | ALAS2-2021-1630 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | jss +1 | 4.7.3-1.module+el8.3.0+7857+983338ee | ELSA-2021-0966 |
| Oracle Linux 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+7857+983338ee | ELSA-2021-0966 |
| Oracle Linux 8 | pki-ca +7 | 10.9.4-3.0.1.module+el8.3.0+el8+9692+a35cea4e | ELSA-2021-0966 |
| Oracle Linux 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7857+983338ee | ELSA-2021-0966 |
| Oracle Linux 7 | pki-ca +7 | 10.5.18-12.el7_9 | ELSA-2021-0851 |
Advisories 11
- RHSA-2021:0851 Red Hat Security Advisory: pki-core security and bug fix update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2021:1263 Red Hat Security Advisory: pki-core:10.6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2021:0975 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2021:0819 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-8158-1 dogtag-pki vulnerability Ubuntu Security Notices (USN) · Apr 16, 2026
- WID-SEC-2024-3648 Red Hat Enterprise Linux pki-core: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 8, 2026
- RLSA-2021:0966 Important: pki-core:10.6 security update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2021:0966 Red Hat Security Advisory: pki-core:10.6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2021-1630 Important: pki-core security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 21, 2021
- ELSA-2021-0966 Important: pki-core:10.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 24, 2021
- ELSA-2021-0851 Important: pki-core security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 17, 2021
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1914379
- https://github.com/dogtagpki/pki/pull/3478
- https://github.com/dogtagpki/pki/pull/3477
- https://github.com/dogtagpki/pki/pull/3476
- https://github.com/dogtagpki/pki/pull/3475
- https://github.com/dogtagpki/pki/pull/3474
- FEDORA-2021-c0d6637ca5 vendor-advisory
- FEDORA-2021-344dd24c84 vendor-advisory
- FEDORA-2021-6c412a4601 vendor-advisory