Home

CVE-2020-14370

Description

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

Risk Information

Base Score
5.3
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.158

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2020:5056) podman security and bug fix update podman-1.6.4-26.el7_9.x86_64.rpmLinux
(RHSA-2020:5056) podman security and bug fix update podman-docker-1.6.4-26.el7_9.noarch.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update buildah-1.16.7-4.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update buildah-debugsource-1.16.7-4.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update buildah-tests-1.16.7-4.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update cockpit-podman-27.1-3.module+el8.3.1+9857+68fb1526.noarch.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update conmon-2.0.22-3.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update conmon-debugsource-2.0.22-3.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update container-selinux-2.155.0-1.module+el8.3.1+9857+68fb1526.noarch.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update containernetworking-plugins-0.9.0-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update containernetworking-plugins-debugsource-0.9.0-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update containers-common-1.2.0-9.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update crit-3.15-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update criu-3.15-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update criu-debugsource-3.15-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update crun-0.16-2.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update crun-debugsource-0.16-2.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update fuse-overlayfs-1.3.0-2.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update fuse-overlayfs-debugsource-1.3.0-2.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update libslirp-4.3.1-1.module+el8.3.1+9803+64eb0fd6.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update libslirp-debugsource-4.3.1-1.module+el8.3.1+9803+64eb0fd6.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update libslirp-devel-4.3.1-1.module+el8.3.1+9803+64eb0fd6.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update oci-seccomp-bpf-hook-1.2.0-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update oci-seccomp-bpf-hook-debugsource-1.2.0-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-catatonit-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-debugsource-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-docker-2.2.1-7.module+el8.3.1+9857+68fb1526.noarch.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-plugins-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-remote-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update podman-tests-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.3.1+9857+68fb1526.noarch.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update python3-criu-3.15-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update runc-1.0.0-70.rc92.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update runc-debugsource-1.0.0-70.rc92.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update skopeo-1.2.0-9.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update skopeo-debugsource-1.2.0-9.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update skopeo-tests-1.2.0-9.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update slirp4netns-1.1.8-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update slirp4netns-debugsource-1.1.8-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update toolbox-0.0.8-1.module+el8.3.1+9857+68fb1526.noarch.rpmLinux
(RHSA-2021:0531) container-tools:rhel8 security, bug fix, and enhancement update udica-0.2.4-1.module+el8.3.1+9857+68fb1526.noarch.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update buildah-debuginfo-1.16.7-4.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update buildah-tests-debuginfo-1.16.7-4.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update conmon-debuginfo-2.0.22-3.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update containernetworking-plugins-debuginfo-0.9.0-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update criu-debuginfo-3.15-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update crun-debuginfo-0.16-2.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update fuse-overlayfs-debuginfo-1.3.0-2.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update libslirp-debuginfo-4.3.1-1.module+el8.3.1+9803+64eb0fd6.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update oci-seccomp-bpf-hook-debuginfo-1.2.0-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update podman-catatonit-debuginfo-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update podman-debuginfo-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update podman-plugins-debuginfo-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update podman-remote-debuginfo-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update runc-debuginfo-1.0.0-70.rc92.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update skopeo-debuginfo-1.2.0-9.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
(RHSA-2021:0531)Moderate: security, bug fix, and enhancement update slirp4netns-debuginfo-1.1.8-1.module+el8.3.1+9857+68fb1526.x86_64.rpmLinux
SUSE-SU-2022:23018-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libseccomp2-2.5.3-150300.10.5.1.x86_64.rpmLinux
SUSE-SU-2022:23018-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libseccomp-devel-2.5.3-150300.10.5.1.x86_64.rpmLinux
SUSE-SU-2022:23018-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libcontainers-common-20210626-150300.8.3.1.noarch.rpmLinux
SUSE-SU-2022:23018-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libseccomp2-debuginfo-2.5.3-150300.10.5.1.x86_64.rpmLinux
SUSE-SU-2022:23018-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libseccomp-debugsource-2.5.3-150300.10.5.1.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234