Unscored severity · published Mar 18, 2008
CVE-2008-1383
The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from…
–
CVSS
0.2%
EPSS
No
On KEV
Description
The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Gentoo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1383
osvdb.org
http://osvdb.org/43479
Vendor Advisory
http://secunia.com/advisories/29436
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200803-30.xml
www.securityfocus.com
http://www.securityfocus.com/bid/28350
bugs.gentoo.org
https://bugs.gentoo.org/show_bug.cgi?id=174759
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/41336
More from Linux
9.8
CVE-2024-12084
Rsync: heap buffer overflow in rsync due to improper checksum length handling
7.5
CVE-2024-12087
Rsync: path traversal vulnerability in rsync
7.5
CVE-2024-12088
Rsync: --safe-links option bypass leads to path traversal
7.5
CVE-2024-12085
Rsync: info leak via uninitialized stack contents
6.8
CVE-2024-12086
A flaw was found in rsync