PyPI/werkzeug CVE-2019-14806: high 7.5, EPSS 1.91%

Pallets Werkzeug Insufficient Entropy

Action: Upgrade werkzeug to 0.15.3 or later.

pip install werkzeug==0.15.3

Affected

Fixed versions

Sources

• osv: GHSA-gq9m-qvpx-68hc
• https://nvd.nist.gov/vuln/detail/CVE-2019-14806
• https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246
• https://github.com/pallets/werkzeug
• https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168
• https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2019-140.yaml
• https://palletsprojects.com/blog/werkzeug-0-15-3-released
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html

CVE-2019-14806 · published 2019-08-21T16:15:24Z · modified 2024-11-19T18:22:43.515928Z · JSON