CVE-2019-14806 Pallets Werkzeug Insufficient Entropy
Insufficient debugger PIN randomness in Werkzeug when used with Docker allows attackers to bypass debugger authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14806?
CVE-2019-14806 is a high-severity vulnerability in Opensuse Leap, published on 9 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Weakness: CWE-331
Which versions are affected by CVE-2019-14806?
3 open source packages ship an affected version, including werkzeug. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
werkzeug PyPI | All versions | 0.15.3 |
werkzeug PyPI | All versions | 0.15.3 |
werkzeug PyPI | All versions | 0.15.3 |
Linux distribution packages (15)
python-Werkzeug SUSE:HPE Helion OpenStack 8 | All versions | 0.12.2-3.3.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 0.12.2-3.3.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 0.14.1-6.3.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Package Hub 15 | All versions | 0.12.2-3.3.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Package Hub 15 SP1 | All versions | 0.14.1-6.3.1 |
python-Werkzeug SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 0.12.2-10.10.1 |
python-Werkzeug SUSE:OpenStack Cloud 8 | All versions | 0.12.2-3.3.1 |
python-Werkzeug SUSE:OpenStack Cloud 9 | All versions | 0.14.1-3.3.1 |
python-Werkzeug SUSE:OpenStack Cloud Crowbar 8 | All versions | 0.12.2-3.3.1 |
python-Werkzeug SUSE:OpenStack Cloud Crowbar 9 | All versions | 0.14.1-3.3.1 |
python-Werkzeug openSUSE:Leap 15.0 | All versions | 0.12.2-lp150.2.3.1 |
python-Werkzeug-doc openSUSE:Leap 15.0 | All versions | 0.12.2-lp150.2.3.1 |
python-Werkzeug openSUSE:Leap 15.1 | All versions | 0.14.1-lp151.2.3.1 |
python-Werkzeug-doc openSUSE:Leap 15.1 | All versions | 0.14.1-lp151.2.3.1 |
python-Werkzeug openSUSE:Tumbleweed | All versions | 2.0.1-1.2 |
Products include Opensuse Leap, Palletsprojects Werkzeug.
How do I fix CVE-2019-14806?
Upgrade werkzeug to 0.15.3 or later.
Is CVE-2019-14806 being exploited?
There is no known exploitation of CVE-2019-14806 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
Sources
Also known as DEBIAN-CVE-2019-14806, GHSA-gq9m-qvpx-68hc, MGASA-2020-0004, PYSEC-2019-140, SUSE-SU-2019:2308-1, SUSE-SU-2019:2358-1 and 8 more.