GitHub Advisoryadvisory · Go

GHSA-65gg-3w2w-hr4h Podman Improper Certificate Validation; machine missing TLS verification

HIGH Published 2025-06-25 Modified 2025-11-29 Official page ↗
Aliases
CVE-2025-6032
Ecosystem
Go
Packages
github.com/containers/podman/v4, github.com/containers/podman/v5
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-295
Reviewed
2025-06-25

Affected packages

• Go github.com/containers/podman/v4: >= 4.8.0, <= 4.9.5 (no fix yet) • Go github.com/containers/podman/v5: < 5.5.2 → fixed in 5.5.2

Description

Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack. Patches https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2 Workarounds Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References