packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash
    passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force
    attack. (CVE-2013-0294)

- Better random number genetator

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
437185	SCA: security update for pyrad (GHSA-q4v3-wmm6-hcrx)	Tenable Cloud Security	SCA Checks	Local	high
437185	SCA: security update for pyrad (GHSA-q4v3-wmm6-hcrx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
70048	Fedora 20 : python-pyrad-2.0-3.fc20 (2013-15838)	Nessus	Fedora Local Security Checks	Local	medium
69897	Fedora 19 : python-pyrad-2.0-3.fc19 (2013-15891)	Nessus	Fedora Local Security Checks	Local	medium
69896	Fedora 18 : python-pyrad-2.0-3.fc18 (2013-15877)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-0294

high

Tenable Plugins

high

high

medium

medium

medium