CVE-2020-14370 in podman
Summary
by MITRE
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/08/2025
This vulnerability exists within the podman container management system affecting versions prior to 2.0.5 and represents a significant information disclosure flaw that can compromise container security. The issue specifically manifests when utilizing deprecated Varlink API or Docker-compatible REST API interfaces where rapid container creation operations occur. The technical root cause stems from improper memory management and variable scoping within the container initialization process, allowing environment variable data from one container instance to persist and leak into subsequent container instances. This cross-contamination occurs due to inadequate isolation mechanisms between container lifecycle operations, creating a persistent information exposure vector that can be exploited by malicious actors.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can enable attackers to access sensitive data stored in environment variables including database credentials, API keys, tokens, and other confidential information. When multiple containers are created in rapid succession, the memory allocation patterns and variable handling mechanisms fail to properly clear or reset environment variable contexts between instances. This flaw particularly affects environments where automated container orchestration occurs, as the rapid deployment cycles increase the probability of exploitation. The vulnerability aligns with CWE-200 (Information Exposure) and can be categorized under ATT&CK technique T1552.1 (Credentials in Files) and T1059.003 (Command and Scripting Interpreter: Windows Command Shell) when exploited in containerized environments.
Security implications are particularly severe in multi-tenant container environments where different applications or users share the same host infrastructure, as the leak could expose credentials from other users' containers. The vulnerability can be exploited through legitimate administrative or developer interfaces, making detection challenging and potentially allowing attackers to maintain persistence within containerized environments. Organizations using podman versions before 2.0.5 should immediately implement mitigation strategies including upgrading to patched versions, disabling deprecated APIs, and implementing strict container isolation policies. Additional protective measures include monitoring for rapid container creation patterns, implementing environment variable sanitization procedures, and conducting regular security assessments of container orchestration systems. The flaw demonstrates the critical importance of proper memory management and isolation in containerized environments, as it represents a fundamental breakdown in container security boundaries that can undermine the entire container security model.