CVE-2020-14370: Infoleak
A flaw was discovered in Podman before upstream version 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first containers will get leaked into subsequent containers. An attacker who has control over those subsequent containers may get access to secrets shared with previous containers through environment variables.
Other sources
An information disclosure flaw was found in containers/podman. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container leak into subsequent containers. This flaw allows an attacker who controls the subsequent containers to gain access to sensitive information stored in such variables. The highest threat from this vulnerability is to confidentiality.
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-14370?
CVE-2020-14370 is an information disclosure vulnerability found in containers/podman versions before 2.0.5.
How does the vulnerability in CVE-2020-14370 work?
The vulnerability in CVE-2020-14370 allows environment variables from the first container to leak into subsequent containers when using the deprecated Varlink API or the Docker-compatible REST API.
What is the severity of CVE-2020-14370?
The severity of CVE-2020-14370 is medium.
How can I fix CVE-2020-14370?
To fix CVE-2020-14370, update to containers/podman version 2.0.5 or later.
Where can I find more information about CVE-2020-14370?
You can find more information about CVE-2020-14370 on the GitHub commit, Bugzilla report, and Red Hat Security Advisory linked in the references section.