CVE-2019-14806

Отчет

While Red Hat Quay contains a vulnerable version of python-werkzeug in the quay container image, use of the debug feature is not recommended in any upstream or downstream documentation. A user of Red Hat Quay would have to enable python-werkzeug debugging before Red Hat Quay became vulnerable. This issue did not affect the versions of python-werkzeug as shipped with Red Hat Update Infrastructure as they did not include support for PIN based authentication. The same is true for the versions of python-werkzeug as shipped with Red Hat Enterprise Linux 8. Red Hat Satellite ships vulnerable python-werkzeug, however, it is not affected because it uses python-werkzeug as a dependency of python-flask required by Crane component and therefore package does not get invoked directly.