GitHub Advisoryadvisory · PyPI

GHSA-q4v3-wmm6-hcrx pyrad is vulnerable to the use of Insufficiently Random Values

HIGH Published 2022-05-05 Modified 2024-10-23 Official page ↗
Aliases
CVE-2013-0294
Ecosystem
PyPI
Packages
pyrad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-330
Reviewed
2024-02-23

Affected packages

• PyPI pyrad: < 2.1 → fixed in 2.1

Description

packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

Related

Alias · CVE (1)

  • CVE-2013-0294 packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for… vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References