TI-2022-07532 Aliases CVE-2022-23472 GHSA-mhhf-vgwh-fw9h

Use of insecure random number generator in Passeo

LOW 34CWE-338Published 2022-12-06 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00859 58th percentileScored 2026-11-07

Fix Fixed Passeo (ArjunSharda): 1.0.5passeo (PyPI): 1.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ArjunSharda	Passeo	before 1.0.5	1.0.5	Patch available	CNA
—	passeo (PyPI)	before 1.0.5	1.0.5	Patch available	GHSA-mhhf-vgwh-fw9h

Passeo VendorArjunSharda Affected before 1.0.5 Fixed in 1.0.5 Patch available CNA
passeo (PyPI) Vendor— Affected before 1.0.5 Fixed in 1.0.5 Patch available GHSA-mhhf-vgwh-fw9h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:passeo_project:passeo::::::python::*	before 1.0.5	Vulnerable	Passeo Project

cpe:2.3:a:passeo_project:passeo:*:*:*:*:*:python:*:* Versions before 1.0.5 Vulnerable ·Passeo Project

Remediation

Fix · CNA Passeo (ArjunSharda) Fixed in 1.0.5
Fix · GHSA-mhhf-vgwh-fw9h passeo (PyPI) Fixed in 1.0.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23472
2026-10-03 Alias added: GHSA-mhhf-vgwh-fw9h

References

Patch 1

https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a

Advisory 3

Other 3

TI-2023-23217 main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences