CVE-2008-1383 The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes...
LowCVSS 1.9
EPSS 0.21%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gentoo linux | All versions | No fix listed |
References
- 43479 vdb-entry
- 29436 third-party-advisory vendor-advisory
- GLSA-200803-30 vendor-advisory
- 28350 vdb-entry
- bugs.gentoo.org
- gentoo-docert-sslkey-weak-security(41336) vdb-entry