PYSEC-2019-140

🗓️ 09 Aug 2019 15:15:00Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 7 Views

PYSEC-2019-140: Pallets Werkzeug before 0.15.3 with Docker has weak debugger PIN randomness due to shared machine id.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: Vulnerability in Werkzeug affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)[CVE-2019-14322, CVE-2019-14806]	11 Mar 202417:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	27 Sep 202313:24	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Werkzeug shipped with PowerAI.	9 Jan 202015:43	–	ibm
BDU FSTEC	The vulnerability of the `generate` function in the Werkzeug web application library, which allows an attacker to gain unauthorized access to confidential data.	27 Apr 202000:00	–	bdu_fstec
CNVD	Pallets Werkzeug Security Feature Issue Vulnerability	12 Aug 201900:00	–	cnvd
CVE	CVE-2019-14806	9 Aug 201914:29	–	cve
Cvelist	CVE-2019-14806	9 Aug 201914:29	–	cvelist
Debian CVE	CVE-2019-14806	9 Aug 201914:29	–	debiancve
EUVD	EUVD-2019-0160	7 Oct 202500:30	–	euvd
Github Security Blog	Pallets Werkzeug Insufficient Entropy	21 Aug 201916:15	–	github

Vulners

Node

pallets werkzeugRange0–0.15.3

Source	Link
github	www.github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246
github	www.github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py
palletsprojects	www.palletsprojects.com/blog/werkzeug-0-15-3-released/
lists	www.lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
lists	www.lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html
github	www.github.com/advisories/GHSA-gq9m-qvpx-68hc

11 Sep 2019 00:15Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 3.17.5

EPSS0.02288