CVE-2020-14370

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Information disclosure in podman in github.com/containers/libpod

This update for podman fixes the following issues:

Security issue fixed:

• This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).

Non-security issues fixed:

• add dependency to timezone package or podman fails to build a container (bsc#1178122)

• Install new auto-update system units

• Update to v2.1.1 (bsc#1178392):

  • Changes
    • The podman info command now includes the cgroup manager Podman is using.
  • API
    • The REST API now includes a Server header in all responses.
    • Fixed a bug where the Libpod and Compat Attach endpoints could terminate early, before sending all output from the container.
    • Fixed a bug where the Compat Create endpoint for containers did not properly handle the Interactive parameter.
    • Fixed a bug where the Compat Kill endpoint for containers could continue to run after a fatal error.
    • Fixed a bug where the Limit parameter of the Compat List endpoint for Containers did not properly handle a limit of 0 (returning nothing, instead of all containers) [#7722].
    • The Libpod Stats endpoint for containers is being deprecated and will be replaced by a similar endpoint with additional features in a future release.

• Changes in v2.1.0

  • Features
    • A new command, podman image mount, has been added. This allows for an image to be mounted, read-only, to inspect its contents without creating a container from it [#1433].
    • The podman save and podman load commands can now create and load archives containing multiple images [#2669].
    • Rootless Podman now supports all podman network commands, and rootless containers can now be joined to networks.
    • The performance of podman build on ADD and COPY instructions has been greatly improved, especially when a .dockerignore is present.
    • The podman run and podman create commands now support a new mode for the --cgroups option, --cgroups=split. Podman will create two cgroups under the cgroup it was launched in, one for the container and one for Conmon. This mode is useful for running Podman in a systemd unit, as it ensures that all processes are retained in systemd's cgroup hierarchy [#6400].
    • The podman run and podman create commands can now specify options to slirp4netns by using the --network option as follows: --net slirp4netns:opt1,opt2. This allows for, among other things, switching the port forwarder used by slirp4netns away from rootlessport.
    • The podman ps command now features a new option, --storage, to show containers from Buildah, CRI-O and other applications.
    • The podman run and podman create commands now feature a --sdnotify option to control the behavior of systemd's sdnotify with containers, enabling improved support for Podman in Type=notify units.
    • The podman run command now features a --preserve-fds opton to pass file descriptors from the host into the container [#6458].
    • The podman run and podman create commands can now create overlay volume mounts, by adding the :O option to a bind mount (e.g. -v /test:/test:O). Overlay volume mounts will mount a directory into a container from the host and allow changes to it, but not write those changes back to the directory on the host.
    • The podman play kube command now supports the Socket HostPath type [#7112].
    • The podman play kube command now supports read-only mounts.
    • The podman play kube command now supports setting labels on pods from Kubernetes metadata labels.
    • The podman play kube command now supports setting container restart policy [#7656].
    • The podman play kube command now properly handles HostAlias…

This update for podman fixes the following issues:

Security issue fixed:

• This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).

Non-security issues fixed:

• add dependency to timezone package or podman fails to build a container (bsc#1178122)

• Install new auto-update system units

• Update to v2.1.1 (bsc#1178392):

  • Changes
    • The podman info command now includes the cgroup manager Podman is using.
  • API
    • The REST API now includes a Server header in all responses.
    • Fixed a bug where the Libpod and Compat Attach endpoints could terminate early, before sending all output from the container.
    • Fixed a bug where the Compat Create endpoint for containers did not properly handle the Interactive parameter.
    • Fixed a bug where the Compat Kill endpoint for containers could continue to run after a fatal error.
    • Fixed a bug where the Limit parameter of the Compat List endpoint for Containers did not properly handle a limit of 0 (returning nothing, instead of all containers) [#7722].
    • The Libpod Stats endpoint for containers is being deprecated and will be replaced by a similar endpoint with additional features in a future release.

• Changes in v2.1.0

  • Features
    • A new command, podman image mount, has been added. This allows for an image to be mounted, read-only, to inspect its contents without creating a container from it [#1433].
    • The podman save and podman load commands can now create and load archives containing multiple images [#2669].
    • Rootless Podman now supports all podman network commands, and rootless containers can now be joined to networks.
    • The performance of podman build on ADD and COPY instructions has been greatly improved, especially when a .dockerignore is present.
    • The podman run and podman create commands now support a new mode for the --cgroups option, --cgroups=split. Podman will create two cgroups under the cgroup it was launched in, one for the container and one for Conmon. This mode is useful for running Podman in a systemd unit, as it ensures that all processes are retained in systemd's cgroup hierarchy [#6400].
    • The podman run and podman create commands can now specify options to slirp4netns by using the --network option as follows: --net slirp4netns:opt1,opt2. This allows for, among other things, switching the port forwarder used by slirp4netns away from rootlessport.
    • The podman ps command now features a new option, --storage, to show containers from Buildah, CRI-O and other applications.
    • The podman run and podman create commands now feature a --sdnotify option to control the behavior of systemd's sdnotify with containers, enabling improved support for Podman in Type=notify units.
    • The podman run command now features a --preserve-fds opton to pass file descriptors from the host into the container [#6458].
    • The podman run and podman create commands can now create overlay volume mounts, by adding the :O option to a bind mount (e.g. -v /test:/test:O). Overlay volume mounts will mount a directory into a container from the host and allow changes to it, but not write those changes back to the directory on the host.
    • The podman play kube command now supports the Socket HostPath type [#7112].
    • The podman play kube command now supports read-only mounts.
    • The podman play kube command now supports setting labels on pods from Kubernetes metadata labels.
    • The podman play kube command now supports setting container restart policy [#7656].
    • The podman play kube command now properly handles HostAlias…

This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues:

podman was updated to 3.4.4.

Security issues fixed:

• fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion

• fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs

• fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost

• Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade path from podman < 3.1.2

Update to version 3.4.4:

• Bugfixes

  • Fixed a bug where the podman exec command would, under some circumstances, print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  • Fixed a bug where named volumes created as part of container creation (e.g. podman run --volume avolume:/a/mountpoint or similar) would be mounted with incorrect permissions (#12523).
  • Fixed a bug where the podman-remote create and podman-remote run commands did not properly handle the --entrypoint='' option (to clear the container's entrypoint) (#12521).

• Update to version 3.4.3:

  • Security

    • This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
    • This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.

  • Features

    • The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).

  • Bugfixes

    • Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
    • Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
    • Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
    • Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
    • Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
    • Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
    • Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
    • Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
    • Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
    • Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
    • Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
    • Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
    • Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
    • Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
    • Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra ' (#11416).

  • API

    • The Libpod Play Kube…

These are all security issues fixed in the podman-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libcontainers-common-20210626-7.1 package on the GA media of openSUSE Tumbleweed.

This update for podman fixes the following issues:

Security issue fixed:

• This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).

Non-security issues fixed:

• add dependency to timezone package or podman fails to build a container (bsc#1178122)

• Install new auto-update system units

• Update to v2.1.1 (bsc#1178392):

  • Changes
    • The podman info command now includes the cgroup manager Podman is using.
  • API
    • The REST API now includes a Server header in all responses.
    • Fixed a bug where the Libpod and Compat Attach endpoints could terminate early, before sending all output from the container.
    • Fixed a bug where the Compat Create endpoint for containers did not properly handle the Interactive parameter.
    • Fixed a bug where the Compat Kill endpoint for containers could continue to run after a fatal error.
    • Fixed a bug where the Limit parameter of the Compat List endpoint for Containers did not properly handle a limit of 0 (returning nothing, instead of all containers) [#7722].
    • The Libpod Stats endpoint for containers is being deprecated and will be replaced by a similar endpoint with additional features in a future release.

• Changes in v2.1.0

  • Features
    • A new command, podman image mount, has been added. This allows for an image to be mounted, read-only, to inspect its contents without creating a container from it [#1433].
    • The podman save and podman load commands can now create and load archives containing multiple images [#2669].
    • Rootless Podman now supports all podman network commands, and rootless containers can now be joined to networks.
    • The performance of podman build on ADD and COPY instructions has been greatly improved, especially when a .dockerignore is present.
    • The podman run and podman create commands now support a new mode for the --cgroups option, --cgroups=split. Podman will create two cgroups under the cgroup it was launched in, one for the container and one for Conmon. This mode is useful for running Podman in a systemd unit, as it ensures that all processes are retained in systemd's cgroup hierarchy [#6400].
    • The podman run and podman create commands can now specify options to slirp4netns by using the --network option as follows: --net slirp4netns:opt1,opt2. This allows for, among other things, switching the port forwarder used by slirp4netns away from rootlessport.
    • The podman ps command now features a new option, --storage, to show containers from Buildah, CRI-O and other applications.
    • The podman run and podman create commands now feature a --sdnotify option to control the behavior of systemd's sdnotify with containers, enabling improved support for Podman in Type=notify units.
    • The podman run command now features a --preserve-fds opton to pass file descriptors from the host into the container [#6458].
    • The podman run and podman create commands can now create overlay volume mounts, by adding the :O option to a bind mount (e.g. -v /test:/test:O). Overlay volume mounts will mount a directory into a container from the host and allow changes to it, but not write those changes back to the directory on the host.
    • The podman play kube command now supports the Socket HostPath type [#7112].
    • The podman play kube command now supports read-only mounts.
    • The podman play kube command now supports setting labels on pods from Kubernetes metadata labels.
    • The podman play kube command now supports setting container restart policy [#7656].
    • The podman play kube command now properly handles HostAlias…

This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues:

podman was updated to 3.4.4.

Security issues fixed:

• fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion

• fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs

• fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost

• Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade path from podman < 3.1.2

Update to version 3.4.4:

• Bugfixes

  • Fixed a bug where the podman exec command would, under some circumstances, print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  • Fixed a bug where named volumes created as part of container creation (e.g. podman run --volume avolume:/a/mountpoint or similar) would be mounted with incorrect permissions (#12523).
  • Fixed a bug where the podman-remote create and podman-remote run commands did not properly handle the --entrypoint='' option (to clear the container's entrypoint) (#12521).

• Update to version 3.4.3:

  • Security

    • This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
    • This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.

  • Features

    • The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).

  • Bugfixes

    • Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
    • Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
    • Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
    • Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
    • Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
    • Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
    • Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
    • Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
    • Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
    • Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
    • Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
    • Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
    • Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
    • Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
    • Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra ' (#11416).

  • API

    • The Libpod Play Kube…

This update for libcontainers-common fixes the following issues:

libcontainers-common was updated:

• common component was updated to 0.44.0.
• storage component was updated to 1.36.0.
• image component was updated to 5.16.0.
• podman component was updated to 3.3.1.

3.3.1:

Bugfixes:

• Fixed a bug where unit files created by podman generate systemd could not cleanup shut down containers when stopped by systemctl stop .
• Fixed a bug where podman machine commands would not properly locate the gvproxy binary in some circumstances.
• Fixed a bug where containers created as part of a pod using the --pod-id-file option would not join the pod's network namespace .
• Fixed a bug where Podman, when using the systemd cgroups driver, could sometimes leak dbus sessions.
• Fixed a bug where the until filter to podman logs and podman events was improperly handled, requiring input to be negated .
• Fixed a bug where rootless containers using CNI networking run on systems using systemd-resolved for DNS would fail to start if resolved symlinked /etc/resolv.conf to an absolute path .

API:

• A large number of potential file descriptor leaks from improperly closing client connections have been fixed.

3.3.0:

Features:

• Containers inside VMs created by podman machine will now automatically handle port forwarding - containers in podman machine VMs that publish ports via --publish or --publish-all will have these ports not just forwarded on the VM, but also on the host system.
• The podman play kube command's --network option now accepts advanced network options (e.g. --network slirp4netns:port_handler=slirp4netns) .
• The podman play kube commmand now supports Kubernetes liveness probes, which will be created as Podman healthchecks.
• Podman now provides a systemd unit, podman-restart.service, which, when enabled, will restart all containers that were started with --restart=always after the system reboots.
• Rootless Podman can now be configured to use CNI networking by default by using the rootless_networking option in containers.conf.
• Images can now be pulled using image:tag@digest syntax (e.g. podman pull fedora:34@sha256:1b0d4ddd99b1a8c8a80e885aafe6034c95f266da44ead992aab388e6aa91611a) .
• The podman container checkpoint and podman container restore commands can now be used to checkpoint containers that are in pods, and restore those containers into pods.
• The podman container restore command now features a new option, --publish, to change the ports that are forwarded to a container that is being restored from an exported checkpoint.
• The podman container checkpoint command now features a new option, --compress, to specify the compression algorithm that will be used on the generated checkpoint.
• The podman pull command can now pull multiple images at once (e.g. podman pull fedora:34 ubi8:latest will pull both specified images).
• THe podman cp command can now copy files from one container into another directly (e.g. podman cp containera:/etc/hosts containerb:/etc/) .
• The podman cp command now supports a new option, --archive, which controls whether copied files will be chown'd to the UID and GID of the user of the destination container.
• The podman stats command now provides two additional metrics: Average CPU, and CPU time.
• The podman pod create command supports a new flag, --pid, to specify the PID namespace of the pod. If specified, containers that join the pod will automatically share its PID namespace.
• The podman pod create command supports a new flag, --infra-name, which allows the name of the pod's infra container to be set .
• The podman auto-update command has had its output reformatted - it is now much clearer what images were pulled and what containers were updated.
• The podman auto-update command now supports a new option, --dry-run, which reports what would be updated but does not actually perform the update .
• The…