Summary
It was discovered that Werkzeug has insufficient debugger PIN randomness.
An attacker could use this issue to access sensitive information. This issue only
affected Ubuntu 18.04 LTS. (CVE-2019-14806)
It was discovered that Werkzeug incorrectly handled certain URLs.
An attacker could possibly use this issue to cause pishing attacks.
This issue only affected Ubuntu 16.04 LTS. (CVE-2020-28724)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | python-werkzeug | 0.10.4+dfsg1-1ubuntu1.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | python-werkzeug | 0.14.1+dfsg1-1ubuntu0.1 |
Vulnerabilities 2
-
High 7.5
Pallets Werkzeug Insufficient Entropy
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
-
Medium 6.1
Open Redirect in werkzeug
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.