Re: CVE request: python-pyrad insecurities

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/15/2013 09:14 AM, Vincent Danen wrote:
> Could a CVE be assigned to the following two issues please?
>
> #1: https://bugzilla.redhat.com/show_bug.cgi?id=911682
>
> Nathaniel McCallum of Red Hat reported that pyrad was using
> Python's random module in a number of places to generate
> pseudo-random data.  In the case of the authenticator data, it was
> being used to secure a password sent over the wire.  Because
> Python's random module is not really suited for this purpose (not
> random enough), it could lead to password hashing that may be
> predictable.

Please use CVE-2013-0294 for this issue.


> #2: https://bugzilla.redhat.com/show_bug.cgi?id=911685
>
> Nathaniel McCallum of Red Hat reported that pyrad was creating 
> serialized RADIUS packet IDs in the CreateID() function in
> packet.py. This is not suitable for RADIUS as the RFC specifies
> that the ID must not be predictable.  As a result, the ID of the
> next packet sent can be spoofed.

Please use CVE-2013-0295 for this issue.

> These have been corrected in upstream's forthcoming version 2.1
> via:
>
> https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRHo5KAAoJEBYNRVNeJnmT32YP/RUrucNudALgorUcvGb12Btf
Xtp5JPu+nYZDWq+i1au4ZMc1TZv12LKSErrvxaQZT04f6K6NvD74drqtHXf1a5ck
NWAsk/RIRFrNmSvwkmL02352LWzKlPLfM7ZsiJgU73XEPmkLYdVCTopgGzKYaWYe
vWKd7C3l1a/2b2I2C+O2OT2jyi89K3LQSzdZVSd7Mf81gDtDnkyQ8RT5QpcCPVRa
XbfKdfzVdLNEw26n5k8/alpjvBARyv4KA7ZA4qQzaI9P32Nw1DFE/8zBbrHkrhj5
V83HyOtQyqrYryreNahGkBtLc1LQZ8b81pOvNaE2FRVgA7M5VA4JH4OaL8NCornJ
ozicUuB/U32D24Ox7UqR+nkScPCBAhj/iVz+lkKac3WHLNGJGSa25WwWjoaWPrip
YaFZHzyijIAdYsr7tHoxTncKNhqtCClyiX6RZdPKKAfDGFV4hPfktwOY8Di6u+hM
B8ANPe+nDi7kB4BQcm5Qj7RJ7KY0eixxYgv4ynhvvmdDlpFJwGh8rIilmCCGdVMa
GDYjVzgR/SXTFOYWZ9pWc90Ixa3wNtqiCHNwUqKmKldHZvyph0XS4K0HM/o0IQny
0aHSg04nSM9jlUOczlCwShhTrRHmTkkuRkXsVlv0ibtORTwcotD/9xghkLK9ktHb
3HiFhtqk0CvJBtNMFcRG
=z9JH
-----END PGP SIGNATURE-----