Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-34069 EUVD-2024-1358GHSA-2g68-c3qc-8985PYSEC-2026-2043

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Published May 6, 2024 · Updated Feb 21, 2025 · Assigned by GitHub_M

Vendor: pallets Product: werkzeug Package: airflow Package: airflow-3 Package: airflow-3-bitnami-compat Package: kubeflow-jupyter-web-app Package: kubeflow-pipelines-visualization-server Package: kubeflow-volumes-web-app Package: py3-werkzeug Package: python-werkzeug Package: python-werkzeug Package: python-werkzeug Package: werkzeug Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

Affected products

VendorProductAffectedFixed
pallets werkzeug < 3.0.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-werkzeug 3.0.3-1 —
Debian 13 python-werkzeug 3.0.3-1 —
Debian 12 python-werkzeug 2.2.2-3+deb12u1 —
Debian 11 python-werkzeug 1.0.1+dfsg1-2+deb11u2 DLA-4062-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS python-werkzeug 3.0.1-3ubuntu0.1 USN-6799-1
Ubuntu 22.04 LTS python-werkzeug 2.0.2+dfsg1-1ubuntu0.22.04.2 USN-6799-1
Ubuntu 20.04 LTS python-werkzeug 0.16.1+dfsg1-2ubuntu0.2 USN-6799-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS python-werkzeug 0.14.1+dfsg1-1ubuntu0.2+esm1 USN-6799-1
Ubuntu Pro 16.04 LTS python-werkzeug 0.10.4+dfsg1-1ubuntu1.2+esm2 USN-6799-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 python-jinja2 +1 3.0.1-3.el9.1 RHSA-2024:5810
Red Hat Openshift Ironic 4 python-werkzeug +1 2.0.3-6.el9 RHSA-2024:6016, RHSA-2024:5810
Red Hat OpenStack 17 python-werkzeug +1 2.0.1-7.el9ost RHSA-2024:9976, RHSA-2024:9975
Red Hat OpenStack 16 python-werkzeug +1 0.14.1-13.el8ost RHSA-2024:10696
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 openshift +1 4.12.0-202408131833.p0.g1eb8682.assembly.stream.el8 RHSA-2024:5810
Red Hat Ceph Storage 7 ceph +25 2:18.2.1-329.el8cp RHSA-2025:4664
Red Hat Ceph Storage 7 cephadm 2:18.2.1-329.el9cp RHSA-2025:4664
Red Hat Ceph Storage 7 liboath +1 2.6.12-1.el8cp RHSA-2025:4664

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-2
SLES 15 SP5 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1
SLES 15 SP4 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1, SUSE-SU-2024:1591-1
SLES 15 SP3 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1
SLES 15 SP2 python-Werkzeug 0.14.1-150100.6.9.1 SUSE-SU-2024:1608-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 python-Werkzeug 0.12.2-10.16.1 SUSE-SU-2024:1572-1
SLES 3 python-Werkzeug 2.3.6-150400.6.9.1 SUSE-SU-2024:1591-2, SUSE-SU-2024:1591-1
SLES for SAP 15 SP4 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1, SUSE-SU-2024:1591-1
SLES for SAP 15 SP3 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1
SLES for SAP 15 SP2 python-Werkzeug 0.14.1-150100.6.9.1 SUSE-SU-2024:1608-1
SLE HPC 15 SP4 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1, SUSE-SU-2024:1591-1
SLE HPC 15 SP3 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1
SLE HPC 15 SP2 python-Werkzeug 0.14.1-150100.6.9.1 SUSE-SU-2024:1608-1
SUSE Manager Server 4.3 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1
SUSE Manager Proxy 4.3 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1
SUSE Enterprise Storage 7.1 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-Werkzeug 3.0.3-1.1 openSUSE-SU-2026:11943-1, openSUSE-SU-2024:14042-1
openSUSE Leap 15.6 python-Werkzeug 2.3.6-150400.6.9.1 SUSE-SU-2024:1591-1
openSUSE Leap 15.6 python-Werkzeug-doc 0.14.1-150100.6.9.1 SUSE-SU-2024:1608-1
openSUSE Leap 15.5 python-Werkzeug 1.0.1-150300.3.8.1 SUSE-SU-2024:1624-1, SUSE-SU-2024:1591-1
openSUSE Leap 15.5 python-Werkzeug-doc 0.14.1-150100.6.9.1 SUSE-SU-2024:1608-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-werkzeug +1 1.0.1-5.amzn2023.0.5 ALAS2023-2024-662

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-werkzeug 3.0.3-1 —
Azure Linux 2 (CBL-Mariner) python-werkzeug 2.3.7-2 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow +1 No fix yet —
Wolfi rolling airflow-3 3.2.0-r0 —
Wolfi rolling kubeflow-jupyter-web-app 1.8.0-r7 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.4.0-r0 —
Wolfi rolling kubeflow-volumes-web-app 1.8.0-r6 —
Wolfi rolling py3-werkzeug 3.0.3-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI werkzeug < 3.0.3 3.0.3 GHSA-2g68-c3qc-8985

Advisories 20

References