What is GHSA-gq9m-qvpx-68hc?

GHSA-gq9m-qvpx-68hc is a security advisory published by GitHub Security Advisories with High severity. Pallets Werkzeug Insufficient Entropy

Which CVE IDs does GHSA-gq9m-qvpx-68hc cover?

GHSA-gq9m-qvpx-68hc covers the following CVE IDs: CVE-2019-14806. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gq9m-qvpx-68hc?

GHSA-gq9m-qvpx-68hc has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-gq9m-qvpx-68hc?

GHSA-gq9m-qvpx-68hc affects 1 product, including: pip/werkzeug:\u003c 0.15.3.

GHSA-gq9m-qvpx-68hcHighCVSS 7.5

Pallets Werkzeug Insufficient Entropy

Vendor

GitHub Security Advisories

Published

August 21, 2019

Last Modified

November 19, 2024

🔗 CVE IDs covered (1)

CVE-2019-14806 →

📋 Description

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

🎯 Affected products1

pip/werkzeug:< 0.15.3

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2019-14806
https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168
https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html
https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2019-140.yaml
https://palletsprojects.com/blog/werkzeug-0-15-3-released
https://github.com/advisories/GHSA-gq9m-qvpx-68hc