CVE-2008-5659
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed...
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
Exploit likelihood
What each source reports
NVD Score used
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
CVE-2008-5659- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
CVE-2008-5659- Updated
- 2026-11-02
EUVDEUVD-2008-5630 No score
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
EUVD-2008-5630- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h5cf-h82c-8jhv No score
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed...
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
GHSA-h5cf-h82c-8jhv- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (1) | 2008-12-05 |
| Exploit-DB | GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (2) | 2008-12-05 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5659 is a high vulnerability (CVSS 7.5) in Gnu Classpath, published December 17, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.35%, the 88th percentile. No source names a fixed version.