Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-20179

A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.

Published

2021-03-15T13:15:14.887

Last Modified

2024-11-21T05:46:04.710

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

4.9

Weaknesses

Type: Primary
CWE-863
Type: Secondary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dogtagpki	dogtagpki	< 10.5.0	Yes
Application	dogtagpki	dogtagpki	< 10.8.0	Yes
Application	dogtagpki	dogtagpki	< 10.9.0	Yes
Application	dogtagpki	dogtagpki	< 10.10.0	Yes
Application	dogtagpki	dogtagpki	< 10.11.0	Yes
Application	redhat	certificate_system	10.0	Yes
Operating System	redhat	enterprise_linux	7.0	Yes
Operating System	redhat	enterprise_linux	8.0	Yes
Operating System	fedoraproject	fedora	32	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	fedoraproject	fedora	34	Yes

References

https://bugzilla.redhat.com/show_bug.cgi?id=1914379 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/dogtagpki/pki/pull/3474 Patch, Third Party Advisory ([email protected])
https://github.com/dogtagpki/pki/pull/3475 Patch, Third Party Advisory ([email protected])
https://github.com/dogtagpki/pki/pull/3476 Patch, Third Party Advisory ([email protected])
https://github.com/dogtagpki/pki/pull/3477 Patch, Third Party Advisory ([email protected])
https://github.com/dogtagpki/pki/pull/3478 Patch, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDOLFOLEIV7I4EUC3SCZBXL6E2ER7ZEN/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRE44N6P24AEDKRMWK7RPRLMCUUBRJII/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3I7BRAHLE2WWSY76W3CKFCF5WSSAE24/ ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=1914379 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dogtagpki/pki/pull/3474 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dogtagpki/pki/pull/3475 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dogtagpki/pki/pull/3476 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dogtagpki/pki/pull/3477 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dogtagpki/pki/pull/3478 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDOLFOLEIV7I4EUC3SCZBXL6E2ER7ZEN/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRE44N6P24AEDKRMWK7RPRLMCUUBRJII/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3I7BRAHLE2WWSY76W3CKFCF5WSSAE24/ (af854a3a-2127-422b-91ae-364da2661108)