CVE-2008-1383: Low severity gentoo linux vulnerability
The docert function in ssl-cert.eclass, when used by srccompile or srcinstall on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1383?
CVE-2008-1383 is considered a medium severity vulnerability due to its potential for exposing sensitive SSL certificates and keys.
How can I mitigate CVE-2008-1383?
To mitigate CVE-2008-1383, ensure SSL keys are not stored in binpkgs and elevate access controls on SSL configurations.
What systems are affected by CVE-2008-1383?
CVE-2008-1383 affects systems running Gentoo Linux that utilize the docert function in ssl-cert.eclass.
What happens if CVE-2008-1383 is exploited?
If exploited, CVE-2008-1383 allows local users to extract SSL keys from binpkgs, leading to possible man-in-the-middle attacks.
What actions should be taken after detecting CVE-2008-1383?
After detecting CVE-2008-1383, replace the compromised SSL keys and review the systems for unauthorized access.