AIKIDO-2024-10410
Werkzeug is vulnerable to Inadequate Encryption Strength
25
Low Risk
This Affects:
WerkzeugTL;DR
Affected versions of the package use an inadequate encryption strength. The default number of PBKDF2 iterations is too low, making the encryption vulnerable to faster brute force or dictionary attacks on modern hardware. Attackers can more easily crack encrypted data, highlighting the need to increase the number of iterations for stronger protection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
Werkzeug is vulnerable to Inadequate Encryption Strength in versions 0.13 - 3.0.6.
How to fix this
Upgrade the Werkzeug library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant