GitHub Advisoryadvisory · Go

GHSA-c3wv-qmjj-45r6 Information disclosure in podman

MEDIUM Published 2024-04-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2020-14370
Ecosystem
Go
Packages
github.com/containers/podman/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-212
Reviewed
2024-04-24

Affected packages

• Go github.com/containers/podman/v2: < 2.0.5 → fixed in 2.0.5

Description

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

Related

Alias · CVE (1)

  • CVE-2020-14370 An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References