CVE-2008-4394

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-10-10 · updated 2026-06-16

Description

Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds.

Affected products

gentoo Portage: through 2.1.4.4; 2.0.51.22-r3, 2.1.1-r2, 2.1.3.10, 2.1.3.11

References

http://secunia.com/advisories/32228
http://security.gentoo.org/glsa/glsa-200810-02.xml
http://www.securityfocus.com/bid/31670
https://exchange.xforce.ibmcloud.com/vulnerabilities/45792
http://secunia.com/advisories/32228
http://security.gentoo.org/glsa/glsa-200810-02.xml
http://www.securityfocus.com/bid/31670
https://exchange.xforce.ibmcloud.com/vulnerabilities/45792

Get alerted when CVE-2008-4394 or the next vulnerability affects your stack