CVE-2008-3280 It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the...
MediumCVSS 5.9
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openid | All versions | No fix listed |
References
- lists.openid.net mailing-list mitigation vendor-advisory
- www.exploit-db.com exploit third-party-advisory vdb-entry