CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2019-14806
High (7.5). EPSS 1.9% chance of exploitation in the next 30 days. Fixed in werkzeug 0.15.3.
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-331
- Published
- Modified
- Record from
- the NVD, synced
Affected
- opensuse:leap
- palletsprojects:werkzeug
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gq9m-qvpx-68hc | PyPI | werkzeug | <0.15.3 | 0.15.3 |
| PYSEC-2019-140 | PyPI | werkzeug | <0.15.3 | 0.15.3 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html
- https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168
- https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246
- https://palletsprojects.com/blog/werkzeug-0-15-3-released/