debian/pyrad vulnerabilities

Latest debian/pyrad CVEs

Newest publication first

1. CVE-2013-0294 pyrad is vulnerable to the use of Insufficiently Random Values

   Published 2020-01-28

   Medium·CVSS 5.9 EPSS 2.8%

   packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

2. CVE-2013-0342 pyrad uses sequential packet IDs

   Published 2019-12-09

   Medium·CVSS 4.3 EPSS 1.5%

   The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.