PyPI/passeo CVE-2022-23472: medium 5.9, EPSS 0.86%

Passeo uses insecure random number generator

Action: Upgrade passeo to 1.0.5 or later.

pip install passeo==1.0.5

Affected

Fixed versions

Sources

• osv: GHSA-mhhf-vgwh-fw9h
• https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h
• https://nvd.nist.gov/vuln/detail/CVE-2022-23472
• https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a
• https://github.com/ArjunSharda/Passeo
• https://github.com/pypa/advisory-database/tree/main/vulns/passeo/PYSEC-2022-42997.yaml
• https://peps.python.org/pep-0506

CVE-2022-23472 · published 2022-12-06T21:13:32Z · modified 2024-10-09T20:24:57.419170Z · JSON