GitHub Advisoryadvisory · PyPI
GHSA-mhhf-vgwh-fw9h Passeo uses insecure random number generator
HIGH
Official page ↗
- Aliases
- CVE-2022-23472
- Ecosystem
- PyPI
- Packages
- passeo
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-338
- Reviewed
- 2022-12-06
Affected packages
• PyPI passeo: < 1.0.5 → fixed in 1.0.5
Description
Impact
Everyone below v1.0.5 is impacted by this flaw, of confidentiality being at risk due to the password(s) being easily able to be guessed with Passeo's use of the ``random`` library. It is recommended to change any passwords made with Passeo before v1.0.5 and upgrade to v1.0.5, and v1.0.5 patches this with the ``secrets`` library.
Workarounds
No current workaround available than updating to v1.0.5.
Related
Alias · CVE (1)
- CVE-2022-23472 Passeo is an open source python password generator. vulnerability
Weakness · CWE (1)
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness
References
- https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h web
- https://nvd.nist.gov/vuln/detail/CVE-2022-23472 advisory
- https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a web
- https://github.com/ArjunSharda/Passeo package
- https://github.com/pypa/advisory-database/tree/main/vulns/passeo/PYSEC-2022-42997.yaml web
- https://peps.python.org/pep-0506 web