PatchTheCVECVE-2022-23472: Passeo is an open source python password generator
CVE-2022-23472 is a medium-severity flaw (CVSS 5.9) affecting passeo. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgr
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.9% (top 42%) |
| CISA exploited list | No |
| Weakness | CWE-338 |
| Published | 2022-12-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-23472?
passeo: upgrade to 1.0.5. Exact commands for each OS are on this page.
Is CVE-2022-23472 being exploited?
CVE-2022-23472 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-23472 affect?
CVE-2022-23472 affects passeo. Severity is medium (CVSS 5.9). Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its relian
How urgent is CVE-2022-23472?
Priority 40/100. Remotely exploitable, no login, no user action