A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
Fixes

Solution

No solution given by the vendor.


Workaround

Download the VM image manually with another tool that verifies the TLS certificate and then pass the local image as a file path to podman, for example: # podman machine init --image <local-image-path>

History

Wed, 30 Jul 2025 22:30:00 +0000

Type Values Removed Values Added
References

Wed, 30 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
References

Tue, 22 Jul 2025 19:45:00 +0000

Type Values Removed Values Added
References

Wed, 09 Jul 2025 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:9.4

Wed, 09 Jul 2025 08:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el8
cpe:/a:redhat:openshift:4.17::el9
References

Wed, 09 Jul 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
Vendors & Products Redhat rhel Eus
References

Tue, 08 Jul 2025 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9

Tue, 08 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:10.0
References

Wed, 02 Jul 2025 08:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el8
cpe:/a:redhat:openshift:4.16::el9
cpe:/a:redhat:openshift:4.18::el8
cpe:/a:redhat:openshift:4.18::el9
References

Tue, 01 Jul 2025 08:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
References

Wed, 25 Jun 2025 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Tue, 24 Jun 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 24 Jun 2025 14:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
Title Podman: podman missing tls verification
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-295
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-09-25T02:43:36.283Z

Reserved: 2025-06-12T15:21:33.840Z

Link: CVE-2025-6032

cve-icon Vulnrichment

Updated: 2025-06-24T14:11:34.059Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-06-24T14:15:30.703

Modified: 2025-07-30T23:15:28.400

Link: CVE-2025-6032

cve-icon Redhat

Severity : Important

Publid Date: 2025-06-24T00:00:00Z

Links: CVE-2025-6032 - Bugzilla

cve-icon OpenCVE Enrichment

No data.