[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <511E8E4A.2050608@redhat.com>
Date: Fri, 15 Feb 2013 12:36:42 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Vincent Danen <vdanen@...hat.com>
Subject: Re: CVE request: python-pyrad insecurities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/15/2013 09:14 AM, Vincent Danen wrote:
> Could a CVE be assigned to the following two issues please?
>
> #1: https://bugzilla.redhat.com/show_bug.cgi?id=911682
>
> Nathaniel McCallum of Red Hat reported that pyrad was using
> Python's random module in a number of places to generate
> pseudo-random data. In the case of the authenticator data, it was
> being used to secure a password sent over the wire. Because
> Python's random module is not really suited for this purpose (not
> random enough), it could lead to password hashing that may be
> predictable.
Please use CVE-2013-0294 for this issue.
> #2: https://bugzilla.redhat.com/show_bug.cgi?id=911685
>
> Nathaniel McCallum of Red Hat reported that pyrad was creating
> serialized RADIUS packet IDs in the CreateID() function in
> packet.py. This is not suitable for RADIUS as the RFC specifies
> that the ID must not be predictable. As a result, the ID of the
> next packet sent can be spoofed.
Please use CVE-2013-0295 for this issue.
>
> These have been corrected in upstream's forthcoming version 2.1
> via:
>
> https://github.com/wichert/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
>
>
>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRHo5KAAoJEBYNRVNeJnmT32YP/RUrucNudALgorUcvGb12Btf
Xtp5JPu+nYZDWq+i1au4ZMc1TZv12LKSErrvxaQZT04f6K6NvD74drqtHXf1a5ck
NWAsk/RIRFrNmSvwkmL02352LWzKlPLfM7ZsiJgU73XEPmkLYdVCTopgGzKYaWYe
vWKd7C3l1a/2b2I2C+O2OT2jyi89K3LQSzdZVSd7Mf81gDtDnkyQ8RT5QpcCPVRa
XbfKdfzVdLNEw26n5k8/alpjvBARyv4KA7ZA4qQzaI9P32Nw1DFE/8zBbrHkrhj5
V83HyOtQyqrYryreNahGkBtLc1LQZ8b81pOvNaE2FRVgA7M5VA4JH4OaL8NCornJ
ozicUuB/U32D24Ox7UqR+nkScPCBAhj/iVz+lkKac3WHLNGJGSa25WwWjoaWPrip
YaFZHzyijIAdYsr7tHoxTncKNhqtCClyiX6RZdPKKAfDGFV4hPfktwOY8Di6u+hM
B8ANPe+nDi7kB4BQcm5Qj7RJ7KY0eixxYgv4ynhvvmdDlpFJwGh8rIilmCCGdVMa
GDYjVzgR/SXTFOYWZ9pWc90Ixa3wNtqiCHNwUqKmKldHZvyph0XS4K0HM/o0IQny
0aHSg04nSM9jlUOczlCwShhTrRHmTkkuRkXsVlv0ibtORTwcotD/9xghkLK9ktHb
3HiFhtqk0CvJBtNMFcRG
=z9JH
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
