CVE-2013-0294 pyrad is vulnerable to the use of Insufficiently Random Values
MediumCVSS 5.9
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pyrad(PyPI) | < 2.1 | 2.1 |
| pypi pyrad(PyPI) | = 1.0 | No fix listed |
| pypi pyrad(PyPI) | = 1.0alpha1 | No fix listed |
| pypi pyrad(PyPI) | = 1.1 | No fix listed |
| pypi pyrad(PyPI) | = 1.2 | No fix listed |
| pypi pyrad(PyPI) | = 2.0 | No fix listed |
| debian/pyrad(Debian:12) | < 2.0-2 | 2.0-2 |
| debian/pyrad(Debian:13) | < 2.0-2 | 2.0-2 |
| debian/pyrad(Debian:14) | < 2.0-2 | 2.0-2 |
| pyrad project pyrad | < 2.1 | 2.1 |
| fedoraproject fedora | = 18 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| pyrad | = before 2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- github.com
- github.com product
- web.archive.org
- lists.fedoraproject.org mailing-list third-party-advisory
- lists.fedoraproject.org mailing-list third-party-advisory
- lists.fedoraproject.org mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-0294 vendor-advisory
- bugs.debian.org issue-tracking