CVE-2013-0294

MediumCVSS 5.9/10Last modified Jun 16, 2026

Description

packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
pyrad	pyrad	before 2.1

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.htmlMailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/02/15/13Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/57984Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=911682Issue Tracking, Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/82133Third Party Advisory, VDB Entry
https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5Patch, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.htmlMailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/02/15/13Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/57984Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=911682Issue Tracking, Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/82133Third Party Advisory, VDB Entry
https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5Patch, Third Party Advisory

Timeline

Published: Jan 28, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-02964.4Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions t CVE-2013-02973.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrato CVE-2013-02984.3Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or CVE-2013-02996.8Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack CVE-2013-03006.8Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authenticatio CVE-2013-03016.8Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers CVE-2013-03025.0Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors r CVE-2013-03036.5Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users t CVE-2013-03044.0ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calen CVE-2013-03054.0The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permission CVE-2013-03065.0The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass inte CVE-2013-03073.5Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to in