CVE-2022-23472CWE-338

Use of insecure random number generator in Passeo

Medium · published December 6, 2022

CVSS v3.1
5.9
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00859 · 58.1th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2022-12-06T17:18Z
EPSS history
Timeline
  • 06 DEC 17:18Z
    Use of insecure random number generator in Passeo
    cvelistv5