Information disclosure in podman
Priority LOW 27CWE-212Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
Why it matters now
EPSS 0.01402 72nd percentileScored 2026-11-07
Fix Partial github.com/containers/podman/v2 (Go): 2.0.5Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | podman | podman versions before 2.0.5 | — | No fix listed | CNA |
| — | github.com/containers/podman/v2 (Go) | before 2.0.5 | 2.0.5 | Patch available | GHSA-c3wv-qmjj-45r6 |
- podman Vendor— Affected podman versions before 2.0.5 Fixed in — No fix listed CNA
- github.com/containers/podman/v2 (Go) Vendor— Affected before 2.0.5 Fixed in 2.0.5 Patch available GHSA-c3wv-qmjj-45r6
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* | before 2.0.5 | Vulnerable | Podman Project |
| cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:* | 4.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* Versions before 2.0.5 Vulnerable ·Podman Project
- cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-c3wv-qmjj-45r6 github.com/containers/podman/v2 (Go) Fixed in 2.0.5 Advisory →
Red Hat 3 advisories
- RHSA-2021:0531 Released 2021-02-16 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.16.7-4.module+el8.3.1+9857+68fb1526.aarch64::container-tools:rhel8, buildah-1.16.7-4.module+el8.3.1+9857+68fb1526.ppc64le::container-tools:rhel8, buildah-1.16.7-4.module+el8.3.1+9857+68fb1526.s390x::container-tools:rhel8 +47
- RHSA-2020:5056 Released 2020-11-10 · Red Hat rating Moderatepodman security and bug fix update
- Red Hat Enterprise Linux 7 Extras podman-1.6.4-26.el7_9, podman-docker-1.6.4-26.el7_9
- RHSA-2020:4297 Released 2020-10-27 · Red Hat rating ModerateOpenShift Container Platform 4.6.1 package security update
- Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-2.rhaos4.6.el8, jenkins-2-plugins-4.6.1601368321-1.el8, openshift-clients-4.6.0-202010081244.p0.git.3794.4743d24.el7 +11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 Extras | Fixed | RHSA-2020:5056 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:0531 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2020:4297 |
Not affected: 3 products
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.6
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14370
- 2026-10-03 Alias added: GHSA-c3wv-qmjj-45r6
References
Advisory 4
Other 5
- https://github.com/containers/podman/commit/a7e864e6e7de894d4edde4fff00e53dc6a0b5074
- https://github.com/containers/podman
- https://lists.fedoraproject.org/archives/list/[email protected]/message/G6BPCZX4ASKNONL3MSCK564IVXNYSKLP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Y74V7HGQBNLT6XECCSNZNFZIB7G7XSAR
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Z4Y2FSGQWP4AFT5AZ6UBN6RKHVXUBRFV
Sources
- CVE-2020-14370 · CVE Program
- CVE-2020-14370 · NVD
- FIRST EPSS
- GHSA-c3wv-qmjj-45r6 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-14370 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences