Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2013-0294: pyrad before 2.1 may expose passwords to attackers
CVE-2013-0294 · published 6 years ago
Summary
The pyrad library versions earlier than 2.1 create authentication data using numbers that are not random enough. This makes it easier for a remote attacker to guess passwords by trying many possibilities. Upgrade pyrad to version 2.1 or later to use stronger random numbers and protect sensitive information.
What to do
- Update christian giese pyrad to version 2.1.
- Update debian pyrad to version 2.0-2.
- Update pyrad_project pyrad to version 2.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | christian giese | pyrad |
< 2.1 Fix: upgrade to 2.1
|
| Debian:12 | debian | pyrad |
< 2.0-2 Fix: upgrade to 2.0-2
|
| Debian:13 | debian | pyrad |
< 2.0-2 Fix: upgrade to 2.0-2
|
| Debian:14 | debian | pyrad |
< 2.0-2 Fix: upgrade to 2.0-2
|
| – | pyrad_project | pyrad |
< 2.1 cpe:2.3:a:pyrad_project:pyrad:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
18 19 20 cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:* |
Original advisory text
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute f...
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-0294
- https://web.archive.org/web/20200228160027/http://www.securityfocus.com/bid/5798...
- https://github.com/pypa/advisory-database/tree/main/vulns/pyrad/PYSEC-2020-211.y...
- https://github.com/advisories/GHSA-q4v3-wmm6-hcrx
- https://security-tracker.debian.org/tracker/CVE-2013-0294 Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.... Mailing List Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.... Mailing List Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.... Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/02/15/13 Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/57984 Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=911682 Issue Tracking Patch Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82133 Third Party Advisory VDB Entry
- https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5 Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-330Use of Insufficiently Random Values
Timeline
Published28 Jan 2020
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta