Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13NHB4LTlwZ20tcDJmM83gaQ

pyrad uses sequential packet IDs

The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

Permalink: https://github.com/advisories/GHSA-w4px-9pgm-p2f3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NHB4LTlwZ20tcDJmM83gaQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 19 days ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Identifiers: GHSA-w4px-9pgm-p2f3, CVE-2013-0342
References:

• https://nvd.nist.gov/vuln/detail/CVE-2013-0342
• https://github.com/pyradius/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
• https://bugzilla.redhat.com/show_bug.cgi?id=911685
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82134
• http://www.openwall.com/lists/oss-security/2013/02/15/9
• http://www.openwall.com/lists/oss-security/2013/02/21/27
• http://www.openwall.com/lists/oss-security/2013/02/22/2
• https://web.archive.org/web/20200302193833/http://www.securityfocus.com/bid/57984
• https://github.com/advisories/GHSA-w4px-9pgm-p2f3

Repository: https://github.com/pyradius/pyrad
Blast Radius: 9.8

Affected Packages