Vulnerability · Published Dec 6, 2022 · Assigned by GitHub_M
CVE-2022-23472Use of insecure random number generator in Passeo
Medium 5.9
In plain English
A medium-severity security flaw in Passeo from ArjunSharda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | passeo | 1.0.5 | GHSA-mhhf-vgwh-fw9h |
| PyPI | passeo | 1.0.5 | PYSEC-2022-42997 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArjunSharda | Passeo | < 1.0.5 |
Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h x_refsource_CONFIRM
- https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a x_refsource_MISC
- https://peps.python.org/pep-0506/ x_refsource_MISC