PT-2020-13983 · Containers+6 · Podman+6
Guilherme De Almeida Suckevicz
·
Published
2020-09-10
·
Updated
2024-06-15
·
CVE-2020-14370
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
containers/podman versions prior to 2.0.5
Description
An information disclosure issue was found in containers/podman. When using the deprecated Varlink API or the Docker-compatible REST API, environment variables from the first container can be leaked into subsequent containers created in a short duration. This could allow an attacker with control over subsequent containers to access sensitive information stored in such variables.
Recommendations
For versions prior to 2.0.5, update to version 2.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the creation of multiple containers in a short duration to minimize the risk of exploitation. Avoid using the deprecated Varlink API or the Docker-compatible REST API for creating containers until the issue is resolved.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Podman