Headline
Ubuntu Security Notice USN-6799-1
Ubuntu Security Notice 6799-1 - It was discovered that the debugger in Werkzeug was not restricted to trusted hosts. A remote attacker could possibly use this issue to execute code on the host under certain circumstances.
==========================================================================
Ubuntu Security Notice USN-6799-1
May 29, 2024
python-werkzeug vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Werkzeug could be made to execute code under certain circumstances.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications
Details:
It was discovered that the debugger in Werkzeug was not restricted to
trusted hosts. A remote attacker could possibly use this issue to execute
code on the host under certain circumstances.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
python3-werkzeug 3.0.1-3ubuntu0.1
Ubuntu 23.10
python3-werkzeug 2.2.2-3ubuntu0.1
Ubuntu 22.04 LTS
python3-werkzeug 2.0.2+dfsg1-1ubuntu0.22.04.2
Ubuntu 20.04 LTS
python3-werkzeug 0.16.1+dfsg1-2ubuntu0.2
Ubuntu 18.04 LTS
python-werkzeug 0.14.1+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro
python3-werkzeug 0.14.1+dfsg1-1ubuntu0.2+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
python-werkzeug 0.10.4+dfsg1-1ubuntu1.2+esm2
Available with Ubuntu Pro
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.2+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6799-1
CVE-2024-34069
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/3.0.1-3ubuntu0.1
https://launchpad.net/ubuntu/+source/python-werkzeug/2.2.2-3ubuntu0.1
https://launchpad.net/ubuntu/+source/python-werkzeug/2.0.2+dfsg1-1ubuntu0.22.04.2
https://launchpad.net/ubuntu/+source/python-werkzeug/0.16.1+dfsg1-2ubuntu0.2
Related news
Red Hat Security Advisory 2024-6016-03 - Red Hat OpenShift Container Platform release 4.15.30 is now available with updates to packages and images that fix several bugs and add enhancements.
The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.