$ cve CVE-2008-0166 JSON

CVE-2008-0166 EXPLOIT

7.5

HIGH · CVSS 3.1 · EPSS 70.7% (pctl 99)

Patch early

A public exploit exists.

Description

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.

Scoring

CVSS	7.5 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	70.72% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-338
On CISA KEV	no
Public exploit	yes
Published	2008-05-13
Last modified	2026-06-16

Affected (3)

Vendor	Product
canonical	ubuntu linux
debian	debian linux
openssl	openssl

Public exploits

Source	Title	Date
exploit-db	OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH	2008-06-01
exploit-db	OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)	2008-05-16
exploit-db	OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH	2008-05-15

References

→ the Explorer · watch your stack · NVD