Insufficient Debugger PIN Randomness in Pallets Werkzeug
Summary
CVE-2019-14806: Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. Affects python-werkzeug across 2 version ranges.
< 0.15.6+dfsg1-1
< 00bc43b1672e662e5e3b8cecd79e67fc968fa246
Fixed in 0.15.6+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pallets Werkzeug is a Python library that provides utilities for building web applications. It is commonly used with Docker containers to enhance the development process. However, versions of Werkzeug before 0.15.3 have a vulnerability related to insufficient randomness in the debugger PIN when used with Docker. This vulnerability arises because Docker containers share the same machine id.
Vulnerability Detail
The vulnerability (CVE-2019-14806) in Pallets Werkzeug allows an attacker to guess the debugger PIN due to insufficient randomness. This could potentially lead to unauthorized access to the debugger interface and sensitive information. The issue arises when Werkzeug is used in conjunction with Docker containers, as they share the same machine id. By exploiting this vulnerability, an attacker could gain access to the debugging functionality and potentially compromise the application.
How To Fix
Minimum fixed version
0.15.6+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-werkzeugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update to the fixed version of Werkzeug.
Conclusion
The vulnerability in Pallets Werkzeug (CVE-2019-14806) can be mitigated by updating to version 0.15.3 or later. It is important for developers to promptly update their dependencies to ensure the security of their applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-werkzeug →
FAQ
Pallets Werkzeug is a Python library that provides utilities for building web applications. It is commonly used with Docker containers to enhance the development process.
The vulnerability allows an attacker to guess the debugger PIN, potentially leading to unauthorized access to the debugger interface and sensitive information.
To fix this vulnerability, update to Werkzeug version 0.15.3 or later.
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended approach.
You can find more information about this vulnerability in the CVE-2019-14806 JSON report: [link to the report].
References
Related vulnerabilities
Recent vulnerabilities recorded for python-werkzeug.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
