CVE-2019-14806

Advisory

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-gq9m-qvpx-68hc
• https://nvd.nist.gov/vuln/detail/CVE-2019-14806
• https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246
• https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug
• https://palletsprojects.com/blog/werkzeug-0-15-3-released/
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806
• https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168