Description
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pki-server | pki-core 10.10.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | dogtag-pki | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 20.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dogtag-pki | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dogtag-pki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | jss +1 | 4.8.1-2.module+el8.4.0+10451+3e5b5448 | RHSA-2021:2235 |
| RHEL 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2021:2235 |
| RHEL 8 | pki-ca +9 | 10.10.5-3.module+el8.4.0+11039+635979e4 | RHSA-2021:2235 |
| RHEL 8 | tomcatjss | 7.6.1-1.module+el8.4.0+8778+d07929ff | RHSA-2021:2235 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | jss | 4.8.1-2.module+el8.4.0+418+b7ae1d4a | RLSA-2021:2235 |
| Rocky Linux 8 | ldapjdk | 4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2021:2235 |
| Rocky Linux 8 | pki-core | 10.10.5-3.module+el8.4.0+554+92b527a1 | RLSA-2021:2235 |
| Rocky Linux 8 | tomcatjss | 7.6.1-1.module+el8.4.0+418+b7ae1d4a | RLSA-2021:2235 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | jss +1 | 4.8.1-2.module+el8.4.0+20154+9830f79e | ELSA-2021-2235 |
| Oracle Linux 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+7857+983338ee | ELSA-2021-2235 |
| Oracle Linux 8 | pki-ca +8 | 10.10.5-3.0.1.module+el8.4.0+20181+8592f730 | ELSA-2021-2235 |
| Oracle Linux 8 | tomcatjss | 7.6.1-1.module+el8.4.0+20053+7cddd5b6 | ELSA-2021-2235 |
Advisories 3
- RLSA-2021:2235 Important: pki-core:10.6 security update Rocky Linux Security Advisories · Feb 4, 2026
- RHSA-2021:2235 Red Hat Security Advisory: pki-core:10.6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2021-2235 Important: pki-core:10.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 4, 2021