Vulnerability record · CVE-2008-0166 · published 13 May 2008
CVE-2008-0166: Debian OpenSSL weak RNG makes cryptographic keys predictable
OOpenssl · Openssl
Debian's OpenSSL packages from 0.9.8c-1 up to before 0.9.8g-9 used a random number generator that produced predictable output, so keys generated on affected systems are drawn from a small, enumerable set. Any key or certificate created on such a host during the affected window should be treated as compromised, and the flaw affects the trust of SSH, TLS, VPN and other key material, not just one service.
Description
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityThe flaw allows remote key recovery with no authentication, has very high EPSS and public exploit tooling, though it is not in KEV and requires keys generated on affected systems.
What it is
Debian's OpenSSL packages from 0.9.8c-1 up to before 0.9.8g-9 used a random number generator that produced predictable output, so keys generated on affected systems are drawn from a small, enumerable set. Any key or certificate created on such a host during the affected window should be treated as compromised, and the flaw affects the trust of SSH, TLS, VPN and other key material, not just one service.
Impact
A remote attacker who can reach a service using an affected key can brute-force the key space and recover private keys, then authenticate or decrypt as the legitimate key holder.
Attack surface
Reachable over the network against any service presenting a key generated on an affected Debian or Ubuntu system; no authentication or user interaction is required, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.707 probability, 99.4th percentile) and multiple references carry Exploit tags, including Exploit-DB entries 5622 and 5632 and a SecurityFocus BID, indicating public tooling exists.
What to do
- Patch OpenSSL to a fixed version (0.9.8g-9 or later) on affected Debian and Ubuntu systems.
- Regenerate all cryptographic keys and certificates created on affected hosts, including SSH host and user keys, TLS certificates, and VPN keys.
- Revoke and replace any certificates or keys that may have been generated during the vulnerable window.
- Audit systems for keys generated on affected hosts and rotate credentials that depend on them.
- Monitor vendor advisories (Debian DSA-1571/1576, Ubuntu USN-612) for the full list of affected packages.
Detection
- Inventory key and certificate creation dates and flag any generated on affected Debian/Ubuntu hosts during the vulnerable period.
- Compare public keys against known weak-key blocklists or the Debian OpenSSL blacklist tooling.
- Monitor authentication logs for successful logins using keys that should have been rotated.
- Scan for hosts still running unpatched OpenSSL versions in the affected range.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-0166 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-0166), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
