CVE-2013-0294: Medium severity pyrad vulnerability
Nathaniel McCallum reported that pyrad was using Python's random module in a number of places to generate pseudo-random data. In the case of the authenticator data, it was being used to secure a password sent over the wire. Because Python's random module is not really suited for this purpose (not random enough), it could lead to password hashing that may be predictable.
This has been corrected in upstream's forthcoming version 2.1 via:
https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
Other sources
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0294?
CVE-2013-0294 is classified as a moderate severity vulnerability affecting the pyrad package.
How do I fix CVE-2013-0294?
To fix CVE-2013-0294, upgrade pyrad to version 2.1 or later.
Which software versions are affected by CVE-2013-0294?
CVE-2013-0294 affects pyrad versions prior to 2.1.
What is the impact of CVE-2013-0294?
The impact of CVE-2013-0294 includes potential exposure of sensitive data due to inadequate random number generation.
Who reported CVE-2013-0294?
CVE-2013-0294 was reported by Nathaniel McCallum.