PT-2019-5137 · Pallets+3 · Werkzeug+3

Nikita Tikhomirov · Published 2019-05-14 · Updated 2024-06-15 · CVE-2019-14806

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pallets Werkzeug versions prior to 0.15.3

Description The issue is related to insufficient entropy in the PIN selection of the generate function in the Werkzeug web application library. This can allow a remote attacker to gain unauthorized access to confidential data. The problem is particularly pronounced when Werkzeug is used with Docker, as Docker containers share the same machine ID, leading to insufficient debugger PIN randomness.

Recommendations For versions prior to 0.15.3, update to version 0.15.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the generate function in the src/werkzeug/debug/ init .py file until a patch is available.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

ALT-PU-2019-2595

BDU:2020-01804

CVE-2019-14806

GHSA-GQ9M-QVPX-68HC

MGASA-2020-0004

OPENSUSE-SU-2019:2118-1

OPENSUSE-SU-2019:2145-1

OPENSUSE-SU-2019_2118-1

OPENSUSE-SU-2019_2145-1

OPENSUSE-SU-2024:11213-1

OPENSUSE-SU-2024:14042-1

PYSEC-2019-140

SUSE-SU-2019:2308-1

SUSE-SU-2019:2358-1

SUSE-SU-2019:2365-1

SUSE-SU-2019:2365-2

SUSE-SU-2019:2400-1

SUSE-SU-2019_2308-1

SUSE-SU-2019_2365-1

SUSE-SU-2019_2365-2

SUSE-SU-2022:3977-1

SUSE-SU-2022_3977-1

USN-4655-1

Affected Products

Alt Linux

Suse

Ubuntu

Werkzeug

References · 51

• https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246 · Patch
• https://advisories.mageia.org/MGASA-2020-0004.html · Security Note
• https://cve.org/CVERecord?id=CVE-2019-14806 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14806 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3977-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01804 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2400-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11213-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2365-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14806 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4655-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gq9m-qvpx-68hc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14806 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-14806 · Vendor Advisory