CVE-2019-14806 : Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

Published 2019-08-09 15:15:13

Updated 2023-03-03 19:34:49

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-14806

Opensuse » Leap » Version: 15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Palletsprojects » Werkzeug
Versions before (<) 0.15.3
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 45 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Assigned by: nvd@nist.gov (Primary)

https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246

unique debugger pin in Docker containers · pallets/werkzeug@00bc43b · GitHub
Patch
https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168

werkzeug/__init__.py at 7fef41b120327d3912fbe12fb64f1951496fcf3e · pallets/werkzeug · GitHub
Product
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html

[security-announce] openSUSE-SU-2019:2145-1: moderate: Security update f
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html

[security-announce] openSUSE-SU-2019:2118-1: moderate: Security update f
Mailing List;Third Party Advisory
https://palletsprojects.com/blog/werkzeug-0-15-3-released/

Werkzeug 0.15.3 Released | The Pallets Projects
Release Notes

Jump to