From b6229fa5cff3cb7a503a3a9956a3ac71f2ecda52 Mon Sep 17 00:00:00 2001 From: Matthew Heon Date: Tue, 8 Sep 2020 09:30:26 -0400 Subject: [PATCH] Fix CVE-2020-14370 Convert defaultEnvVariables to a function to ensure that we do not have a variable that can leak between container creation calls. This resolve CVE-2020-14370 for the 1.6 branch of Podman. Signed-off-by: Matthew Heon --- cmd/podman/shared/create.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/cmd/podman/shared/create.go b/cmd/podman/shared/create.go index dda36826e..b9f346691 100644 --- a/cmd/podman/shared/create.go +++ b/cmd/podman/shared/create.go @@ -822,15 +822,17 @@ func CreateContainerFromCreateConfig(r *libpod.Runtime, createConfig *cc.CreateC return ctr, nil } -var defaultEnvVariables = map[string]string{ - "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", - "TERM": "xterm", +func defaultEnvVariables() map[string]string { + return map[string]string{ + "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM": "xterm", + } } // EnvVariablesFromData gets sets the default environment variables // for containers, and reads the variables from the image data, if present. func EnvVariablesFromData(data *inspect.ImageData) map[string]string { - env := defaultEnvVariables + env := defaultEnvVariables() if data != nil { for _, e := range data.Config.Env { split := strings.SplitN(e, "=", 2) -- 2.26.2