CVE-2013-0294 pyrad is vulnerable to the use of Insufficiently Random Values

What is CVE-2013-0294?

CVE-2013-0294 is a medium-severity vulnerability in Fedoraproject Fedora, published on 28 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

Weakness: CWE-330

Which versions are affected by CVE-2013-0294?

3 open source packages ship an affected version, including pyrad. It affects 2 products.

Products include Fedoraproject Fedora, Pyrad Project Pyrad.

How do I fix CVE-2013-0294?

Upgrade pyrad to 2.1 or later.

Is CVE-2013-0294 being exploited?

There is no known exploitation of CVE-2013-0294 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-0294, GHSA-q4v3-wmm6-hcrx, PYSEC-2020-211.