CVE-2013-0342 pyrad uses sequential packet IDs
MediumCVSS 4.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pyrad(PyPI) | < 2.1 | 2.1 |
| pypi pyrad(PyPI) | = 1.0 | No fix listed |
| pypi pyrad(PyPI) | = 1.0alpha1 | No fix listed |
| pypi pyrad(PyPI) | = 1.1 | No fix listed |
| pypi pyrad(PyPI) | = 1.2 | No fix listed |
| pypi pyrad(PyPI) | = 2.0 | No fix listed |
| debian/pyrad(Debian:12) | All versions | No fix listed |
| debian/pyrad(Debian:12) | = 2.1-3 | No fix listed |
| debian/pyrad(Debian:12) | = 2.4-1 | No fix listed |
| debian/pyrad(Debian:12) | = 2.5.2-1 | No fix listed |
| debian/pyrad(Debian:12) | = 2.5.2-2 | No fix listed |
| debian/pyrad(Debian:13) | All versions | No fix listed |
| debian/pyrad(Debian:13) | = 2.4-1 | No fix listed |
| debian/pyrad(Debian:13) | = 2.5.2-1 | No fix listed |
| debian/pyrad(Debian:13) | = 2.5.2-2 | No fix listed |
| debian/pyrad(Debian:14) | All versions | No fix listed |
| debian/pyrad(Debian:14) | = 2.4-1 | No fix listed |
| debian/pyrad(Debian:14) | = 2.5.2-1 | No fix listed |
| debian/pyrad(Debian:14) | = 2.5.2-2 | No fix listed |
| pyrad project pyrad | < 2.1 | 2.1 |
| ubuntu/pyrad(Ubuntu:24.04) | All versions | No fix listed |
| pyrad | = before 2.1 | No fix listed |
| ubuntu/pyrad(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/pyrad(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/pyrad(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- github.com
- github.com product
- web.archive.org
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- github.com vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2013-0342 vendor-advisory
- bugs.debian.org issue-tracking