CVE-2020-14370

5.3 mediumEPSS 1.4%

Medium (5.3). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/containers/podman/v2 2.0.5.

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-212
Published: 2020-09-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fedoraproject:fedora
podman_project:podman
redhat:enterprise_linux
redhat:openshift_container_platform

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-c3wv-qmjj-45r6	Go	github.com/containers/podman/v2	<2.0.5	2.0.5
GO-2024-2766	Go	github.com/containers/libpod	all versions	no fix published
GO-2024-2766	Go	github.com/containers/libpod/v2	<2.0.5	2.0.5

References

Check your stack JSON