High severity · published Mar 15, 2021
CVE-2021-20179
A flaw was found in pki-core
8.1
CVSS
1.2%
EPSS
No
On KEV
Description
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Certificate System · Redhat
10.0 · source: NVD
DO
Dogtagpki · Dogtagpki
before 10.5.0; 10.5.1 before 10.8.0; 10.8.1 before 10.9.0; 10.9.1 before 10.10.0; 10.10.1 before 10.11.0 · source: NVD
EL
Enterprise Linux · Redhat
7.0; 8.0 · source: NVD
FE
Fedora · Fedoraproject
32; 33; 34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20179
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20179
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1914379
Patch
https://github.com/dogtagpki/pki/pull/3474
Patch
https://github.com/dogtagpki/pki/pull/3475
Patch
https://github.com/dogtagpki/pki/pull/3476
Patch
https://github.com/dogtagpki/pki/pull/3477
Patch
https://github.com/dogtagpki/pki/pull/3478
More from Dogtagpki
8.1
CVE-2018-1080
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed
7.8
CVE-2021-3551
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file
7.5
CVE-2022-2414
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks
7.5
CVE-2017-7537
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4
6.8
CVE-2020-15720
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation