CVE-2020-14370

Name of the Vulnerable Software and Affected Versions containers/podman versions prior to 2.0.5

Description An information disclosure issue was found in containers/podman. When using the deprecated Varlink API or the Docker-compatible REST API, environment variables from the first container can be leaked into subsequent containers created in a short duration. This could allow an attacker with control over subsequent containers to access sensitive information stored in such variables.

Recommendations For versions prior to 2.0.5, update to version 2.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the creation of multiple containers in a short duration to minimize the risk of exploitation. Avoid using the deprecated Varlink API or the Docker-compatible REST API for creating containers until the issue is resolved.