1. Home
  2. CVE Database
  3. CVE-2020-14370
MEDIUM · 5.3

CVE-2020-14370

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are cre...

Vulnerability Description

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Podman ProjectPodman< 2.0.5
RedhatOpenshift Container Platform4.6
RedhatEnterprise Linux7.0
FedoraprojectFedora31

Related Weaknesses (CWE)

CWE-212

References

FAQ

What is CVE-2020-14370?

CVE-2020-14370 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are cre...

How severe is CVE-2020-14370?

CVE-2020-14370 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-14370?

Check the references section above for vendor advisories and patch information. Affected products include: Podman Project Podman, Redhat Openshift Container Platform, Redhat Enterprise Linux, Fedoraproject Fedora.