CVE-2008-3280

2021-05-2119:23:55

CWE-338

redhat

www.cve.org

6.8 Medium

AI Score

Confidence

High

0.133 Low

EPSS

Percentile

95.6%

JSON

It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.

CNA Affected

[
  {
    "product": "openid",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  }
]