CVE-2021-20179

pki-core: Unprivileged users can renew any certificate

Loading…

Severity

Important

Red Hat Product Security

8.1

CVSS 3.1

Review impact separately from score.

Published · March 12, 2021

Updated · November 22, 2025

Description

A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.

Statement

Red Hat Certificate System 10.1 has been fixed via the Red Hat Enterprise Linux 8 errata RHSA-2021:0966
Red Hat Certificate System 10.2 and newer are not affected by this flaw

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-863 · Incorrect Authorization