PT-2019-20157 · Pallets · Werkzeug

Published 2019-08-09 · Updated 2019-08-09

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 0.15.3

Description The issue is related to insufficient debugger PIN randomness in Werkzeug when used with Docker. This is because Docker containers share the same machine id, which can lead to predictable debugger PINs.

Recommendations For versions prior to 0.15.3, update to version 0.15.3 or later to resolve the issue.

Related Identifiers

PYSEC-2019-70

Affected Products

Werkzeug

References · 6

• https://osv.dev/vulnerability/PYSEC-2019-70 · Vendor Advisory
• https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246 · Note
• https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168 · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html · Note
• https://palletsprojects.com/blog/werkzeug-0-15-3-released · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html · Note