CVE-2020-14370
Fixed in a distro release EPSS 1%
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
Products: podman_project podman, redhat openshift_container_platform, redhat enterprise_linux, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containers/libpod | no fix |
| Go | github.com/containers/libpod/v2 | 2.0.5 |
| Go | github.com/containers/podman/v2 | 2.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | crit | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | libslirp | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | libslirp-devel | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39 |
| AlmaLinux 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 |
| AlmaLinux 8 | python3-criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | slirp4netns | 1.1.8-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux 8 | udica | 0.2.4-1.module_el8.6.0+2876+9ed4eae2 |
| Arch Linux | podman | 2.1.0-1 |
| Debian 12 | libpod | 2.0.6+dfsg1-1 |
| Red Hat Enterprise Linux 8 | buildah | 0:1.16.7-4.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | buildah-debuginfo | 0:1.16.7-4.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | buildah-debugsource | 0:1.16.7-4.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | buildah-tests | 0:1.16.7-4.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | buildah-tests-debuginfo | 0:1.16.7-4.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | cockpit-podman | 0:27.1-3.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | conmon | 2:2.0.22-3.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | conmon-debuginfo | 2:2.0.22-3.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | conmon-debugsource | 2:2.0.22-3.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | container-selinux | 2:2.155.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins | 0:0.9.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debuginfo | 0:0.9.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | containernetworking-plugins-debugsource | 0:0.9.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | containers-common | 1:1.2.0-9.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | crit | 0:3.15-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | criu | 0:3.15-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | criu-debuginfo | 0:3.15-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | criu-debugsource | 0:3.15-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | crun | 0:0.16-2.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | crun-debuginfo | 0:0.16-2.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | crun-debugsource | 0:0.16-2.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs | 0:1.3.0-2.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debuginfo | 0:1.3.0-2.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | fuse-overlayfs-debugsource | 0:1.3.0-2.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | libslirp | 0:4.3.1-1.module+el8.3.1+9803+64eb0fd6 |
| Red Hat Enterprise Linux 8 | libslirp-debuginfo | 0:4.3.1-1.module+el8.3.1+9803+64eb0fd6 |
| Red Hat Enterprise Linux 8 | libslirp-debugsource | 0:4.3.1-1.module+el8.3.1+9803+64eb0fd6 |
| Red Hat Enterprise Linux 8 | libslirp-devel | 0:4.3.1-1.module+el8.3.1+9803+64eb0fd6 |
| Red Hat Enterprise Linux 8 | oci-seccomp-bpf-hook | 0:1.2.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | oci-seccomp-bpf-hook-debuginfo | 0:1.2.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | oci-seccomp-bpf-hook-debugsource | 0:1.2.0-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-catatonit | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-catatonit-debuginfo | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-debuginfo | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-debugsource | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-docker | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-plugins | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-plugins-debuginfo | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-remote | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-remote-debuginfo | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | podman-tests | 0:2.2.1-7.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | python3-criu | 0:3.15-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | runc | 0:1.0.0-70.rc92.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | runc-debuginfo | 0:1.0.0-70.rc92.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | runc-debugsource | 0:1.0.0-70.rc92.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | skopeo | 1:1.2.0-9.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | skopeo-debuginfo | 1:1.2.0-9.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | skopeo-debugsource | 1:1.2.0-9.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | skopeo-tests | 1:1.2.0-9.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | slirp4netns-debuginfo | 0:1.1.8-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | slirp4netns-debugsource | 0:1.1.8-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | toolbox | 0:0.0.8-1.module+el8.3.1+9857+68fb1526 |
| Red Hat Enterprise Linux 8 | udica | 0:0.2.4-1.module+el8.3.1+9857+68fb1526 |
| Red Hat openshift 4.6 | containers-common | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat openshift 4.6 | jenkins-2-plugins | 0:4.6.1601368321-1.el8 |
| Red Hat openshift 4.6 | openshift-clients | 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 |
| Red Hat openshift 4.6 | openshift-clients | 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 |
| Red Hat openshift 4.6 | openshift-clients-redistributable | 0:4.6.0-202010081244.p0.git.3794.4743d24.el8 |
| Red Hat openshift 4.6 | openshift-clients-redistributable | 0:4.6.0-202010081244.p0.git.3794.4743d24.el7 |
| Red Hat openshift 4.6 | podman | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | podman-debuginfo | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | podman-debugsource | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | podman-docker | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | podman-remote | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | podman-remote-debuginfo | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | podman-tests | 0:1.9.3-3.rhaos4.6.el8 |
| Red Hat openshift 4.6 | runc | 0:1.0.0-81.rhaos4.6.git5b757d4.el7 |
| Red Hat openshift 4.6 | runc | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
| Red Hat openshift 4.6 | runc-debuginfo | 0:1.0.0-81.rhaos4.6.git5b757d4.el7 |
| Red Hat openshift 4.6 | runc-debuginfo | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
| Red Hat openshift 4.6 | runc-debugsource | 0:1.0.0-81.rhaos4.6.git5b757d4.el8 |
| Red Hat openshift 4.6 | skopeo | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat openshift 4.6 | skopeo-debuginfo | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat openshift 4.6 | skopeo-debugsource | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat openshift 4.6 | skopeo-tests | 1:1.1.1-2.rhaos4.6.el8 |
| Red Hat rhel extras other 7 | podman | 0:1.6.4-26.el7_9 |
| Red Hat rhel extras other 7 | podman-debuginfo | 0:1.6.4-26.el7_9 |
| Red Hat rhel extras other 7 | podman-docker | 0:1.6.4-26.el7_9 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | criu | 0:3.15-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | libslirp | 0:4.3.1-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 0:1.2.0-1.module+el8.4.0+558+7340b765 |
| Rocky Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 |
| Rocky Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861 |
| Rocky Linux 8 | python-podman-api | 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.6.0+783+10209741 |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.4.0+537+38cf4e42 |
| Rocky Linux 8 | slirp4netns | 0:1.1.8-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | toolbox | 0:0.0.8-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.7.0+1076+9b1c11c1 |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.4.0+556+40122d08 |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.5.0+709+440d5e7e |
| Rocky Linux 8 | udica | 0:0.2.4-1.module+el8.6.0+783+10209741 |
| SUSE Enterprise Storage 6 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Enterprise Storage 7 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Enterprise Storage 7 | podman | 2.1.1-4.28.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Micro 5.1 | conmon | 2.0.30-150300.8.3.1 |
| SUSE Linux Enterprise Micro 5.1 | libcontainers-common | 20210626-150300.8.3.1 |
| SUSE Linux Enterprise Micro 5.1 | libseccomp | 2.5.3-150300.10.5.1 |
| SUSE Linux Enterprise Micro 5.1 | podman | 3.4.4-150300.9.3.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | libcontainers-common | 20210626-150300.8.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | libseccomp | 2.5.3-150300.10.5.1 |
| SUSE Linux Enterprise Module for Containers 15 SP1 | podman | 2.1.1-4.28.1 |
| SUSE Linux Enterprise Module for Containers 15 SP2 | podman | 2.1.1-4.28.1 |
| SUSE Linux Enterprise Module for Containers 15 SP3 | conmon | 2.0.30-150300.8.3.1 |
| SUSE Linux Enterprise Module for Containers 15 SP3 | podman | 3.4.4-150300.9.3.2 |
| SUSE Linux Enterprise Server 15 SP1-BCL | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Manager Proxy 4.1 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Manager Retail Branch Server 4.1 | libcontainers-common | 20210626-150100.3.15.1 |
| SUSE Manager Server 4.1 | libcontainers-common | 20210626-150100.3.15.1 |
| openSUSE Leap 15.1 | podman | 2.1.1-lp151.3.25.1 |
| openSUSE Leap 15.2 | podman | 2.1.1-lp152.4.6.1 |
| openSUSE Leap 15.3 | conmon | 2.0.30-150300.8.3.1 |
| openSUSE Leap 15.3 | libcontainers-common | 20210626-150300.8.3.1 |
| openSUSE Leap 15.3 | libseccomp | 2.5.3-150300.10.5.1 |
| openSUSE Leap 15.3 | podman | 3.4.4-150300.9.3.2 |
| openSUSE Tumbleweed | libcontainers-common | 20210626-7.1 |
| openSUSE Tumbleweed | podman | 3.3.1-2.1 |