GHSA-mhhf-vgwh-fw9h

Passeo uses insecure random number generator

Source: GitHub Advisory Database (reviewed) High CVE-2022-23472

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	passeo	< 1.0.5	1.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Everyone below v1.0.5 is impacted by this flaw, of confidentiality being at risk due to the password(s) being easily able to be guessed with Passeo's use of the ``random`` library. It is recommended to change any passwords made with Passeo before v1.0.5 and upgrade to v1.0.5, and v1.0.5 patches this with the ``secrets`` library. ### Workarounds No current workaround available than updating to v1.0.5.

References

External links from the advisory. They lead to third-party sites.

https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h web
https://nvd.nist.gov/vuln/detail/CVE-2022-23472 advisory
https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a web
https://github.com/ArjunSharda/Passeo package
https://github.com/pypa/advisory-database/tree/main/vulns/passeo/PYSEC-2022-42997.yaml web
https://peps.python.org/pep-0506 web