CVE-2008-3280
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys,...
CVE-2008-3280 is a medium vulnerability (CVSS 5.9) in Diso Development Team Openid, published May 21, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.95%, the 90th percentile. No source names a fixed version.
- Severity
- 5.9 MediumCVSS 3.1, NVD
- Exploit chance
- 3.95%EPSS, 90th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH | 2008-06-01 |
What each source reports
NVD Score used
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
- Record
CVE-2008-3280- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-338
- Updated
- 2026-11-02
CVE ListNo score
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
- Record
CVE-2008-3280- Weakness
- CWE-338
- Updated
- 2026-11-02
EUVDEUVD-2008-3268No score
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
- Record
EUVD-2008-3268- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cq23-cxpr-f49xNo score
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys,...
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
- Record
GHSA-cq23-cxpr-f49x- Weakness
- CWE-338
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.