CVE-2013-0342 json
pyrad uses sequential packet IDs
published 2019-12-09 6 y ago modified 2026-06-16 4 mo ago also GHSA-w4px-9pgm-p2f3 , PYSEC-2019-154 , EUVD-2019-0109
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
Patch / fix
- pypi pyrad 2.1
- pyrad_project pyrad 2.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2013-0342 updated cvss 5.8
python-pyrad: CreateID() creates serialized packet IDs for RADIUS
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.54% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyrad | <2.1 |
2.1 |
Affected products
- pyrad pyrad
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/pyradius/pyrad/commit/38f74b36814ca5b1a27d9898141126af4953bee5
web, third-party-advisory, patch
-
bugzilla.redhat.com
/show_bug.cgi?id=911685
web, issue-tracking, patch, third-party-advisory, report
-
openwall.com
/lists/oss-security/2013/02/15/9
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2013/02/22/2
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2013/02/21/27
web, mailing-list, third-party-advisory
-
securityfocus.com
/bid/57984
third-party-advisory, vdb-entry, web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/82134
web, third-party-advisory, vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2013-0342
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/pyrad/PYSEC-2019-154.yaml
web
-
github.com
/pyradius/pyrad
package
-
web.archive.org
/web/20200302193833/http://www.securityfocus.com/bid/57984
web
-
github.com
/advisories/GHSA-w4px-9pgm-p2f3
advisory
Sources
- CVE List CVE-2013-0342
- GitHub Advisory GHSA-w4px-9pgm-p2f3
- NVD CVE-2013-0342
- OSV PYSEC-2019-154
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.