CVE-2021-3551: 
NixOS vulnerability analysis and mitigation

CVE-2021-3551 is a security vulnerability discovered in the PKI-server component of Dogtag PKI, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. The vulnerability affects PKI-core version 10.10 and was disclosed in May 2021 (NVD, Red Hat).

The vulnerability stems from the PKI installer 'pkispawn' logging admin credentials into a world-readable log file when run in debug mode. The credentials exposed are the 389-DS LDAP server's Directory Manager credentials, which have unrestricted root-level access. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows a local attacker to retrieve the admin password from the log file and gain administrative privileges to the Dogtag CA manager. In IdM/FreeIPA installations, the compromised Directory Manager credentials can be used to read and manipulate Kerberos KDC master passwords, Kerberos keytabs, hashed user passwords, and other sensitive data. Any IdM and FreeIPA installations with PKI 10.10 should be considered potentially compromised (Red Hat).

The vulnerability was fixed in pki-core version 10.10.6. Red Hat released security advisory RHSA-2021:2235 to address this issue in Red Hat Enterprise Linux 8. Users should update to the patched version to prevent exploitation (Red Hat).

The vulnerability was discovered and reported by Christian Heimes (Bugzilla).