CVE-2008-5659
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed...
CVE-2008-5659 is a high vulnerability (CVSS 7.5) in Gnu Classpath, published December 17, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.35%, the 88th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 3.35%EPSS, 88th percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (1) | 2008-12-05 |
| Exploit-DB | GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (2) | 2008-12-05 |
What each source reports
NVD Score used
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
CVE-2008-5659- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
CVE-2008-5659- Updated
- 2026-11-02
EUVDEUVD-2008-5630No score
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
EUVD-2008-5630- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h5cf-h82c-8jhvNo score
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed...
The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it easier for context-dependent attackers to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
- Record
GHSA-h5cf-h82c-8jhv- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.