Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1018 advisory.

    Werkzeug ======== Werkzeug started as simple collection of various     utilities for WSGI applications and has become one of the most advanced     WSGI utility modules. It includes a powerful debugger, full featured     request and response objects, HTTP utilities to handle entity tags, cache     control headers, HTTP dates, cookie handling, file uploads, a powerful URL     routing system and a bunch of community contributed addon modules. Werkzeug     is unicode aware and doesn't enforce a specific template engine, database     adapter or anything else. It doesn't even enforce a specific way of     handling requests and leaves all that up to the developer. It's most useful     for end user applications which should work on as many server environments     as possible (such as blogs, wikis, bulletin boards, etc.).

    Security Fix(es):

    * high resource usage when parsing multipart form data with many fields     (CVE-2023-25577)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-12709 advisory.

    - Fix CVE-2023-23934 [Orabug: 35662419]
    - Fix CVE-2023-25577 [Orabug: 35662419]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5470 advisory.

  - Werkzeug is a comprehensive WSGI web application library. Browsers may allow nameless cookies that look     like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an     adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug     prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is     running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser,     the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in     Werkzeug 2.2.3. (CVE-2023-23934)

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue. (CVE-2023-25577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5948-2 advisory.

    USN-5948-1 fixed vulnerabilities in Werkzeug. This update provides the corresponding updates for Ubuntu     23.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-werkzeug package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Werkzeug is a comprehensive WSGI web application library. Browsers may allow 'nameless' cookies that look     like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an     adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug     prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is     running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser,     the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in     Werkzeug 2.2.3. (CVE-2023-23934)

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue. (CVE-2023-25577)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-149 advisory.

  - Werkzeug is a comprehensive WSGI web application library. Browsers may allow nameless cookies that look     like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an     adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug     prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is     running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser,     the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in     Werkzeug 2.2.3. (CVE-2023-23934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-af75e27098 advisory.

    Update to python-werkzeug-2.2.3.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5948-1 advisory.

    It was discovered that Werkzeug did not properly handle the parsing of nameless cookies. A remote attacker     could possibly use this issue to shadow other cookies. (CVE-2023-23934)

    It was discovered that Werkzeug could be made to process unlimited number of multipart form data parts. A     remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial     of service. (CVE-2023-25577)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8d94dccc7e advisory.

    Update to python-werkzeug-2.2.3.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3346 advisory.

  - Werkzeug is a comprehensive WSGI web application library. Browsers may allow nameless cookies that look     like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an     adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug     prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is     running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser,     the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in     Werkzeug 2.2.3. (CVE-2023-23934)

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue. (CVE-2023-25577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195803	RHEL 7 : python-werkzeug (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	low
194302	RHEL 9 : Red Hat OpenStack Platform 17.0 (python-werkzeug) (RHSA-2023:1018)	Nessus	Red Hat Local Security Checks	low
179846	Oracle Linux 8 : python-werkzeug (ELSA-2023-12709)	Nessus	Oracle Linux Local Security Checks	low
179394	Debian DSA-5470-1 : python-werkzeug - security update	Nessus	Debian Local Security Checks	low
177460	Ubuntu 23.04 : Werkzeug vulnerabilities (USN-5948-2)	Nessus	Ubuntu Local Security Checks	low
176997	EulerOS 2.0 SP5 : python-werkzeug (EulerOS-SA-2023-2167)	Nessus	Huawei Local Security Checks	low
173856	Amazon Linux 2023 : python3-werkzeug (ALAS2023-2023-149)	Nessus	Amazon Linux Local Security Checks	low
172621	Fedora 37 : mingw-python-werkzeug (2023-af75e27098)	Nessus	Fedora Local Security Checks	low
172504	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Werkzeug vulnerabilities (USN-5948-1)	Nessus	Ubuntu Local Security Checks	low
172464	Fedora 38 : mingw-python-werkzeug (2023-8d94dccc7e)	Nessus	Fedora Local Security Checks	low
171932	Debian DLA-3346-1 : python-werkzeug - LTS security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2023-23934

low

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low