GoogleOSV:GHSA-Q4V3-WMM6-HCRXpyrad is vulnerable to the use of Insufficiently Random Values
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
References
lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.html
lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.html
lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.html
www.openwall.com/lists/oss-security/2013/02/15/13
bugzilla.redhat.com/show_bug.cgi?id=911682
exchange.xforce.ibmcloud.com/vulnerabilities/82133
github.com/pyradius/pyrad
github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
nvd.nist.gov/vuln/detail/CVE-2013-0294
web.archive.org/web/20200228160027/www.securityfocus.com/bid/57984
Related
