CVE-2008-1383

Severity: low (CVSS 1.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-03-18 · updated 2026-06-16
Weakness: CWE-310

Description

The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate.

Affected products

gentoo Linux: all versions

References

http://osvdb.org/43479
http://secunia.com/advisories/29436
http://security.gentoo.org/glsa/glsa-200803-30.xml
http://www.securityfocus.com/bid/28350
https://bugs.gentoo.org/show_bug.cgi?id=174759
https://exchange.xforce.ibmcloud.com/vulnerabilities/41336
http://osvdb.org/43479
http://secunia.com/advisories/29436
http://security.gentoo.org/glsa/glsa-200803-30.xml
http://www.securityfocus.com/bid/28350
https://bugs.gentoo.org/show_bug.cgi?id=174759
https://exchange.xforce.ibmcloud.com/vulnerabilities/41336

Get alerted when CVE-2008-1383 or the next vulnerability affects your stack