Medium severity5.9NVD Advisory· Published Dec 6, 2022· Updated Jun 17, 2026
CVE-2022-23472
CVE-2022-23472
Description
Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python random library for random value selection. The python random library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
passeoPyPI | < 1.0.5 | 1.0.5 |
Affected products
3- Range: < 1.0.5
Patches
Vulnerability mechanics
References
7- github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361anvdPatchThird Party AdvisoryWEB
- github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9hnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-mhhf-vgwh-fw9hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-23472ghsaADVISORY
- peps.python.org/pep-0506/nvdThird Party Advisory
- github.com/pypa/advisory-database/tree/main/vulns/passeo/PYSEC-2022-42997.yamlghsaWEB
- peps.python.org/pep-0506ghsaWEB
News mentions
0No linked articles in our index yet.