PT-2019-20157 · Pallets · Werkzeug

Publicado 2019-08-09 · Atualizado 2019-08-09

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 0.15.3

Description The issue is related to insufficient debugger PIN randomness in Werkzeug when used with Docker. This is because Docker containers share the same machine id, which can lead to predictable debugger PINs.

Recommendations For versions prior to 0.15.3, update to version 0.15.3 or later to resolve the issue.

Identificadores relacionados

PYSEC-2019-70

Produtos afetados

Werkzeug

Referências · 6

• https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246 · Nota
• https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-70 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html · Nota
• https://palletsprojects.com/blog/werkzeug-0-15-3-released · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html · Nota