It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
Advisories
Source ID Title
EUVD EUVD EUVD-2008-3268 It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T09:28:42.000Z

Reserved: 2008-07-24T00:00:00

Link: CVE-2008-3280

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-05-21T20:15:07.430

Modified: 2024-11-21T00:48:52.517

Link: CVE-2008-3280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.