CVE-2019-14806
Pallets Werkzeug Insufficient Entropy
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
CVE-2019-14806- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
CVE List No score
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
CVE-2019-14806- Updated
- 2026-11-02
EUVDEUVD-2019-0160 No score
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
EUVD-2019-0160- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gq9m-qvpx-68hc
Pallets Werkzeug Insufficient Entropy
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
GHSA-gq9m-qvpx-68hc- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
OSV
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
CVE-2019-14806- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14806
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
DEBIAN-CVE-2019-14806- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 16 moreShow less
OSVGHSA-gq9m-qvpx-68hc
Pallets Werkzeug Insufficient Entropy
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
GHSA-gq9m-qvpx-68hc- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14806
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
UBUNTU-CVE-2019-14806- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0004 No score
Updated python-werkzeug packages fix security vulnerability
Updated python-werkzeug packages fix security vulnerability:
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id (CVE-2019-14806).
- Record
MGASA-2020-0004- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2118-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2118-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2145-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2019:2145-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11213-1 No score
python36-Werkzeug-2.0.1-1.2 on GA media
These are all security issues fixed in the python36-Werkzeug-2.0.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11213-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14042-1 No score
python310-Werkzeug-3.0.3-1.1 on GA media
These are all security issues fixed in the python310-Werkzeug-3.0.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14042-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11943-1 No score
python313-Werkzeug-3.1.9-1.1 on GA media
These are all security issues fixed in the python313-Werkzeug-3.1.9-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11943-1- Updated
- 2026-11-02
OSVPYSEC-2019-140 No score
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- Record
PYSEC-2019-140- Updated
- 2026-11-02
OSVSUSE-SU-2019:2308-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
- Record
SUSE-SU-2019:2308-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2358-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
- Record
SUSE-SU-2019:2358-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2365-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
- Record
SUSE-SU-2019:2365-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2365-2 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
- Record
SUSE-SU-2019:2365-2- Updated
- 2026-11-02
OSVSUSE-SU-2019:2400-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
Security issue fixed:
- CVE-2019-14806: Fixed the development server in Docker, the debugger security pin is now unique per container (bsc#1145383).
- Record
SUSE-SU-2019:2400-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3977-1 No score
Security update for python-Werkzeug
This update for python-Werkzeug fixes the following issues:
- CVE-2019-14806: Fixed insufficient debugger PIN randomness when running the development server in Docker containers (bsc#1145383).
- Record
SUSE-SU-2022:3977-1- Updated
- 2026-11-02
OSVUSN-4655-1 No score
python-werkzeug vulnerabilities
It was discovered that Werkzeug has insufficient debugger PIN randomness. An attacker could use this issue to access sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-14806)
It was discovered that Werkzeug incorrectly handled certain URLs. An attacker could possibly use this issue to cause pishing attacks. This issue only affected Ubuntu 16.04 LTS. (CVE-2020-28724)
- Record
USN-4655-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
werkzeugPyPI |
before 0.15.3 | 0.15.3 |
python-werkzeugDebian:12 |
before 0.15.6+dfsg1-1 | 0.15.6+dfsg1-1 |
python-werkzeugDebian:13 |
before 0.15.6+dfsg1-1 | 0.15.6+dfsg1-1 |
python-werkzeugDebian:14 |
before 0.15.6+dfsg1-1 | 0.15.6+dfsg1-1 |
werkzeugPyPI |
before 0.15.3, plus listed versions 0.10.100.10.10.10.20.10.3 Show 45 moreShow less0.10.40.110.11.10.11.100.11.110.11.120.11.130.11.140.11.150.11.20.11.30.11.40.11.50.11.60.11.70.11.80.11.90.120.12.10.12.20.130.140.14.10.15.00.15.10.15.20.20.30.3.10.40.4.10.50.5.10.60.6.10.6.20.70.7.10.7.20.80.8.10.8.20.8.30.90.9.1 |
0.15.3 |
python-werkzeugMageia:7 |
before 0.15.3-1.mga7 | 0.15.3-1.mga7 |
werkzeugPyPI |
before 0.15.3, plus listed versions 0.10.20.30.3.10.4 Show 45 moreShow less0.4.10.50.5.10.60.6.10.6.20.70.7.10.7.20.80.8.10.8.20.8.30.90.9.10.9.20.9.30.9.40.9.50.9.60.100.10.10.10.20.10.30.10.40.110.11.10.11.20.11.30.11.40.11.50.11.60.11.70.11.80.11.90.11.100.11.110.11.120.11.130.11.140.11.150.120.12.10.12.20.13 |
0.15.3 |
python-WerkzeugSUSE:Linux Enterprise Module for Basesystem 15 |
before 0.12.2-3.3.1 | 0.12.2-3.3.1 |
python-WerkzeugSUSE:Linux Enterprise Module for Package Hub 15 |
before 0.12.2-3.3.1 | 0.12.2-3.3.1 |
python-WerkzeugSUSE:HPE Helion OpenStack 8 |
before 0.12.2-3.3.1 | 0.12.2-3.3.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-WerkzeugSUSE:OpenStack Cloud 8 |
before 0.12.2-3.3.1 | 0.12.2-3.3.1 |
python-WerkzeugSUSE:OpenStack Cloud Crowbar 8 |
before 0.12.2-3.3.1 | 0.12.2-3.3.1 |
python-WerkzeugSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 0.14.1-6.3.1 | 0.14.1-6.3.1 |
python-WerkzeugSUSE:Linux Enterprise Module for Package Hub 15 SP1 |
before 0.14.1-6.3.1 | 0.14.1-6.3.1 |
python-WerkzeugSUSE:OpenStack Cloud 9 |
before 0.14.1-3.3.1 | 0.14.1-3.3.1 |
python-WerkzeugSUSE:OpenStack Cloud Crowbar 9 |
before 0.14.1-3.3.1 | 0.14.1-3.3.1 |
python-WerkzeugSUSE:Linux Enterprise Module for Public Cloud 12 |
before 0.12.2-10.10.1 | 0.12.2-10.10.1 |
python-werkzeugUbuntu:18.04:LTS |
before 0.14.1+dfsg1-1ubuntu0.1, plus listed versions 0.12.2+dfsg1-20.13+dfsg1-10.14.1+dfsg1-1 |
0.14.1+dfsg1-1ubuntu0.1 |
python-werkzeugUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 0.10.4+dfsg1-1ubuntu1.2, plus listed versions 0.10.4+dfsg1-1ubuntu10.10.4+dfsg1-1ubuntu1.1 |
0.10.4+dfsg1-1ubuntu1.2 |
python-werkzeugUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 0.14.1+dfsg1-1ubuntu0.1, plus listed versions 0.12.2+dfsg1-20.13+dfsg1-10.14.1+dfsg1-1 |
0.14.1+dfsg1-1ubuntu0.1 |
python-WerkzeugopenSUSE:Leap 15.0 |
before 0.12.2-lp150.2.3.1 | 0.12.2-lp150.2.3.1 |
python-Werkzeug-docopenSUSE:Leap 15.0 |
before 0.12.2-lp150.2.3.1 | 0.12.2-lp150.2.3.1 |
python-WerkzeugopenSUSE:Leap 15.1 |
before 0.14.1-lp151.2.3.1 | 0.14.1-lp151.2.3.1 |
python-Werkzeug-docopenSUSE:Leap 15.1 |
before 0.14.1-lp151.2.3.1 | 0.14.1-lp151.2.3.1 |
python-WerkzeugopenSUSE:Tumbleweed |
before 2.0.1-1.2 | 2.0.1-1.2 |
python-WerkzeugopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.0.3-1.1 | 3.0.3-1.1 |
python-WerkzeugopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 3.1.9-1.1 | 3.1.9-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14806 is a high vulnerability (CVSS 7.5) in Palletsprojects Werkzeug, published August 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in werkzeug 0.15.3.
References
github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py
palletsprojects.com/blog/werkzeug-0-15-3-released
lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2019-14806
Show 26 moreShow less
security-tracker.debian.org/tracker/CVE-2019-14806
advisories.mageia.org/MGASA-2020-0004.html
bugs.mageia.org/show_bug.cgi?id=25768
suse.com/support/update/announcement/2019/suse-su-20192308-1
bugzilla.suse.com/1145383
ubuntu.com/security/CVE-2019-14806
cve.org/CVERecord?id=CVE-2019-14806
Left out here: 10 versions. The JSON record has them.