CVE-2019-14806

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

While Red Hat Quay contains a vulnerable version of python-werkzeug in the quay container image, use of the debug feature is not recommended in any upstream or downstream documentation. A user of Red Hat Quay would have to enable python-werkzeug debugging before Red Hat Quay became vulnerable.

This issue did not affect the versions of python-werkzeug as shipped with Red Hat Update Infrastructure as they did not include support for PIN based authentication. The same is true for the versions of python-werkzeug as shipped with Red Hat Enterprise Linux 8.

Red Hat Satellite ships vulnerable python-werkzeug, however, it is not affected because it uses python-werkzeug as a dependency of python-flask required by Crane component and therefore package does not get invoked directly.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.