Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

passeo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2PyPIAmendedPublished

    Passeo uses insecure random number generator

    CVE-2022-23472 · GHSA-mhhf-vgwh-fw9h

    Affected
    • PyPI passeo < 1.0.5
    Fixed in
    1.0.5· Vendor fix available
    Issue
    Impact Everyone below v1.0.5 is impacted by this flaw, of confidentiality being at risk due to the password(s) being easily able to be guessed with Passeo's use of the random library. It is recommended to change any passwords made with Passeo before v1.0.5 and upgrade to v1.0.5, and v1.0.5 patches this with the secrets library. Workarounds No current workaround available than updating to v1.0.5.

    Recommended action: Upgrade to 1.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →