Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-23472

Good to know:

icon
icon

Date: December 6, 2022

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Language: Python

Severity Score

Related Resources (8)

https://peps.python.org/pep-0506
https://github.com/ArjunSharda/Passeo
https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h
https://github.com/pypa/advisory-database/tree/main/vulns/passeo/PYSEC-2022-42997.yaml
https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a
https://peps.python.org/pep-0506/
https://nvd.nist.gov/vuln/detail/CVE-2022-23472
https://www.mend.io/vulnerability-database/CVE-2022-23472

Severity Score

Weakness Type (CWE)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CWE-338

Top Fix

icon

Upgrade Version

Upgrade to version passeo - 1.0.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us