id: PYSEC-2020-211
details: packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS
  authenticators and hash passwords, which makes it easier for remote attackers to
  obtain sensitive information via a brute force attack.
affected:
- package:
    name: pyrad
    ecosystem: PyPI
    purl: pkg:pypi/pyrad
  ranges:
  - type: GIT
    repo: https://github.com/wichert/pyrad
    events:
    - introduced: "0"
    - fixed: 38f74b36814ca5b1a27d9898141126af4953bee5
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "2.1"
  versions:
  - "1.0"
  - 1.0alpha1
  - "1.1"
  - "1.2"
  - "2.0"
references:
- type: WEB
  url: http://www.securityfocus.com/bid/57984
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/02/15/13
- type: WEB
  url: 
    http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.html
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=911682
- type: WEB
  url: 
    http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.html
- type: WEB
  url: 
    http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.html
- type: FIX
  url: https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/82133
- type: ADVISORY
  url: https://github.com/advisories/GHSA-q4v3-wmm6-hcrx
aliases:
- CVE-2013-0294
- GHSA-q4v3-wmm6-hcrx
modified: "2021-07-05T00:01:25.072912Z"
published: "2020-01-28T16:15:00Z"