Important: pki-core:10.6 security update

2021-06-0307:53:39

errata.almalinux.org

JSON

The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.

Security Fix(es):

pki-server: Dogtag installer “pkispawn” logs admin credentials into a world-readable log file (CVE-2021-3551)

The PKI installer “pkispawn” logs admin credentials into a
world-readable log file. It also looks like the installer is passing the
password as an insecure command line argument. The credentials are the
389-DS LDAP server’s Directory Manager credentials. The Directory
Manager is 389-DS’ equivalent of unrestricted root account. The user
bypasses permission checks and grants full access to data. In an IdM /
FreeIPA installation the DM user is able to read and manipulate Kerberos
KDC master password, Kerberos keytabs, hashed user passwords, and more.
Any and all IdM and FreeIPA installations with PKI 10.10 should be
considered compromised.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8x86_64jss< 4.8.1-2.module_el8.4.0+2337+9830f79ejss-4.8.1-2.module_el8.4.0+2337+9830f79e.x86_64.rpm
almalinux8x86_64jss-javadoc< 4.8.1-2.module_el8.4.0+2337+9830f79ejss-javadoc-4.8.1-2.module_el8.4.0+2337+9830f79e.x86_64.rpm
almalinux8noarchldapjdk< 4.22.0-1.module_el8.3.0+2061+d5cd4219ldapjdk-4.22.0-1.module_el8.3.0+2061+d5cd4219.noarch.rpm
almalinux8noarchldapjdk-javadoc< 4.22.0-1.module_el8.3.0+2061+d5cd4219ldapjdk-javadoc-4.22.0-1.module_el8.3.0+2061+d5cd4219.noarch.rpm
almalinux8noarchpki-acme< 10.10.5-3.module_el8.4.0+2467+635979e4pki-acme-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux8noarchpki-base< 10.10.5-3.module_el8.4.0+2467+635979e4pki-base-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux8noarchpki-base-java< 10.10.5-3.module_el8.4.0+2467+635979e4pki-base-java-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux8noarchpki-ca< 10.10.5-3.module_el8.4.0+2467+635979e4pki-ca-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux8noarchpki-kra< 10.10.5-3.module_el8.4.0+2467+635979e4pki-kra-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux8noarchpki-server< 10.10.5-3.module_el8.4.0+2467+635979e4pki-server-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	x86_64	jss	< 4.8.1-2.module_el8.4.0+2337+9830f79e	jss-4.8.1-2.module_el8.4.0+2337+9830f79e.x86_64.rpm
almalinux	8	x86_64	jss-javadoc	< 4.8.1-2.module_el8.4.0+2337+9830f79e	jss-javadoc-4.8.1-2.module_el8.4.0+2337+9830f79e.x86_64.rpm
almalinux	8	noarch	ldapjdk	< 4.22.0-1.module_el8.3.0+2061+d5cd4219	ldapjdk-4.22.0-1.module_el8.3.0+2061+d5cd4219.noarch.rpm
almalinux	8	noarch	ldapjdk-javadoc	< 4.22.0-1.module_el8.3.0+2061+d5cd4219	ldapjdk-javadoc-4.22.0-1.module_el8.3.0+2061+d5cd4219.noarch.rpm
almalinux	8	noarch	pki-acme	< 10.10.5-3.module_el8.4.0+2467+635979e4	pki-acme-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux	8	noarch	pki-base	< 10.10.5-3.module_el8.4.0+2467+635979e4	pki-base-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux	8	noarch	pki-base-java	< 10.10.5-3.module_el8.4.0+2467+635979e4	pki-base-java-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux	8	noarch	pki-ca	< 10.10.5-3.module_el8.4.0+2467+635979e4	pki-ca-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux	8	noarch	pki-kra	< 10.10.5-3.module_el8.4.0+2467+635979e4	pki-kra-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm
almalinux	8	noarch	pki-server	< 10.10.5-3.module_el8.4.0+2467+635979e4	pki-server-10.10.5-3.module_el8.4.0+2467+635979e4.noarch.rpm