Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2008-0166 — Use of Cryptographically Weak Pseudo-Random Number Generator in Openssl
Severity
7.5HIGHNVD
EPSS
2.5%
top 14.66%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedMay 13
Latest updateMay 1
Description
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages3 packages
Also affects: Debian Linux 4.0, Ubuntu Linux 6.06, 7.04, 7.10, 8.04
Patches
🔴Vulnerability Details
3💥Exploits & PoCs
3Exploit-DB
▶
Exploit-DB▶
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)↗2008-05-16
Exploit-DB
▶