Most recent entries from all

ALSA-2021:0531 — Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Affected: AlmaLinux:8: crit, AlmaLinux:8: criu, AlmaLinux:8: libslirp, AlmaLinux:8: libslirp-devel, AlmaLinux:8: python-podman-api, AlmaLinux:8: python3-criu, AlmaLinux:8: slirp4netns, AlmaLinux:8: udica

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn: BELL-CVE-2020-14370 — CVE-2020-14370 does not affect BellSoft software

Withdrawn by the publisher.

EUVD-2026-42398

fkie_cve-2020-14370

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

GHSA-c3wv-qmjj-45r6 — Information disclosure in podman

Affected: Go: github.com/containers/podman/v2

gsd-2020-14370

openSUSE-SU-2020:2039-1 — Security update for podman

Security update for podman

RHSA-2020:4297 — Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update

jenkins-jira-plugin: plugin information disclosure jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read arbitrary files jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP endpoints implementing connection tests. kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API golang: data race in certain net/http servers including ReverseProxy can lead to DoS golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

SUSE-SU-2020:3378-1 — Security update for podman

Security update for podman