Vulnerability in Gentoo Portage

CVE-2008-4394

Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds.

EPSS: 0.003 (26.4th percentile) — read the EPSS interpretation.

Affected products

Gentoo Portage — versions 2.0.51.22, 2.1.1, 2.1.3.10
N/a — versions n/a

References

cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
cve@mitre.org (vendor-advisory, x_refsource_GENTOO)
cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (vdb-entry, x_refsource_XF)