CVE-2021-20179

Upstream information

CVE-2021-20179 at MITRE

Description

A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	5.5
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:N
Access Vector	Network
Access Complexity	Low
Authentication	Single
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	None

CVSS v3 Scores

	National Vulnerability Database
Base Score	8.1
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	None
CVSSv3 Version	3.1

No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 7	pki-base >= 10.5.18-12.el7_9 pki-base-java >= 10.5.18-12.el7_9 pki-ca >= 10.5.18-12.el7_9 pki-javadoc >= 10.5.18-12.el7_9 pki-kra >= 10.5.18-12.el7_9 pki-server >= 10.5.18-12.el7_9 pki-symkey >= 10.5.18-12.el7_9 pki-tools >= 10.5.18-12.el7_9	Patchnames: RHSA-2021:0851
SUSE Liberty Linux 8	jss >= 4.7.3-1.module+el8.3.0+8058+d5cd4219 jss-javadoc >= 4.7.3-1.module+el8.3.0+8058+d5cd4219 ldapjdk >= 4.22.0-1.module+el8.3.0+6784+6e1e4c62 ldapjdk-javadoc >= 4.22.0-1.module+el8.3.0+6784+6e1e4c62 pki-base >= 10.9.4-3.module+el8.3.0+10353+73f6df5b pki-base-java >= 10.9.4-3.module+el8.3.0+10353+73f6df5b pki-ca >= 10.9.4-3.module+el8.3.0+10353+73f6df5b pki-kra >= 10.9.4-3.module+el8.3.0+10353+73f6df5b pki-server >= 10.9.4-3.module+el8.3.0+10353+73f6df5b pki-symkey >= 10.9.4-3.module+el8.3.0+10353+73f6df5b pki-tools >= 10.9.4-3.module+el8.3.0+10353+73f6df5b python3-pki >= 10.9.4-3.module+el8.3.0+10353+73f6df5b tomcatjss >= 7.5.0-1.module+el8.3.0+7355+c59bcbd9	Patchnames: RHSA-2021:0966

---

SUSE Timeline for this CVE

CVE page created: Fri Mar 12 14:28:35 2021
CVE page last modified: Mon Oct 30 18:12:57 2023