PT-2022-16013 · Python · Random+1

Arjun Sharda + 1 · Published 2022-12-06 · Updated 2022-12-08 · CVE-2022-23472

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Passeo versions prior to 1.0.5

Description Passeo is an open source python password generator that relies on the python random library for random value selection in versions prior to 1.0.5. The python random library is not suitable for security purposes due to its non-cryptographically secure random number generator, which may allow a motivated attacker to guess generated passwords.

Recommendations For versions prior to 1.0.5, upgrade to version 1.0.5, which addresses this issue by using the secrets library. It is also recommended to change any passwords generated with Passeo before version 1.0.5.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2022-23472

GHSA-MHHF-VGWH-FW9H

PYSEC-2022-42997

Affected Products

Random

Secrets

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23472.json · Exploit
• https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23472 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23472 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42997 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mhhf-vgwh-fw9h · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/passeo/PYSEC-2022-42997.yaml · Note
• https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h · Note
• https://github.com/ArjunSharda/Passeo · Note
• https://t.me/cibsecurity/54080 · Telegram Post
• https://peps.python.org/pep-0506 · Note