{"id":"CVE-2025-6032","state":"PUBLISHED","title":"Podman: podman missing tls verification","description":"A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.","publishedAt":"2025-06-24T13:50:47.955Z","updatedAt":"2026-10-12T19:53:07.271Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["podman","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support","Red Hat Red Hat OpenShift Container Platform 4.16","Red Hat Red Hat OpenShift Container Platform 4.17","Red Hat Red Hat OpenShift Container Platform 4.18","Red Hat Red Hat OpenShift Container Platform 4.19","Red Hat Red Hat OpenShift Container Platform 4.20","Red Hat Red Hat OpenShift Container Platform 4"],"affected":[{"packageName":"podman","defaultStatus":"unaffected","versions":[{"version":"4.8.0","status":"affected","lessThan":"5.5.2","versionType":"semver"}],"collectionURL":"https://github.com/containers/podman/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"podman","defaultStatus":"affected","versions":[{"version":"6:5.4.0-12.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"container-tools:rhel8","defaultStatus":"affected","versions":[{"version":"8100020250625105344.afee755d","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.4.0-12.el9_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"podman","defaultStatus":"affected","versions":[{"version":"4:4.9.4-18.el9_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"podman","defaultStatus":"affected","versions":[{"version":"4:4.9.4-14.rhaos4.16.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el8","cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"416.94.202507222002-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.2.2-8.rhaos4.17.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el8","cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"417.94.202507132309-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"418.94.202507221927-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.2.2-9.rhaos4.18.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el8","cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"4.19.9.6.202507152218-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.4.0-6.rhaos4.19.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"4.20.9.6.202509251656-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":["https://access.redhat.com/errata/RHSA-2025:10295","https://access.redhat.com/errata/RHSA-2025:10549","https://access.redhat.com/errata/RHSA-2025:10550","https://access.redhat.com/errata/RHSA-2025:10551","https://access.redhat.com/errata/RHSA-2025:10668","https://access.redhat.com/errata/RHSA-2025:11359","https://access.redhat.com/errata/RHSA-2025:11363","https://access.redhat.com/errata/RHSA-2025:11677","https://access.redhat.com/errata/RHSA-2025:11681","https://access.redhat.com/errata/RHSA-2025:15397","https://access.redhat.com/errata/RHSA-2025:9726","https://access.redhat.com/errata/RHSA-2025:9751","https://access.redhat.com/errata/RHSA-2025:9766","https://access.redhat.com/security/cve/CVE-2025-6032","https://bugzilla.redhat.com/show_bug.cgi?id=2372501","https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3","https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/6xxx/CVE-2025-6032.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-6032","state":"PUBLISHED","datePublished":"2025-06-24T13:50:47.955Z","dateUpdated":"2026-10-12T19:53:07.271Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-06-12T15:21:33.840Z"},"containers":{"cna":{"title":"Podman: podman missing tls verification","descriptions":[{"lang":"en","value":"A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack."}],"affected":[{"packageName":"podman","defaultStatus":"unaffected","versions":[{"version":"4.8.0","status":"affected","lessThan":"5.5.2","versionType":"semver"}],"collectionURL":"https://github.com/containers/podman/"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"podman","defaultStatus":"affected","versions":[{"version":"6:5.4.0-12.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"container-tools:rhel8","defaultStatus":"affected","versions":[{"version":"8100020250625105344.afee755d","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.4.0-12.el9_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"podman","defaultStatus":"affected","versions":[{"version":"4:4.9.4-18.el9_4.2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"podman","defaultStatus":"affected","versions":[{"version":"4:4.9.4-14.rhaos4.16.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el8","cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"416.94.202507222002-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.2.2-8.rhaos4.17.el8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el8","cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"417.94.202507132309-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"418.94.202507221927-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.2.2-9.rhaos4.18.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el8","cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"4.19.9.6.202507152218-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"podman","defaultStatus":"affected","versions":[{"version":"5:5.4.0-6.rhaos4.19.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift/ose-rhel-coreos-9","defaultStatus":"affected","versions":[{"version":"4.20.9.6.202509251656-0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift/ose-rhel-coreos-8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10295","name":"RHSA-2025:10295","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10549","name":"RHSA-2025:10549","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10550","name":"RHSA-2025:10550","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10551","name":"RHSA-2025:10551","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10668","name":"RHSA-2025:10668","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11359","name":"RHSA-2025:11359","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11363","name":"RHSA-2025:11363","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11677","name":"RHSA-2025:11677","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11681","name":"RHSA-2025:11681","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:15397","name":"RHSA-2025:15397","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9726","name":"RHSA-2025:9726","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9751","name":"RHSA-2025:9751","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9766","name":"RHSA-2025:9766","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6032","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372501","name":"RHBZ#2372501","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3"},{"url":"https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","description":"Improper Certificate Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-12T19:53:07.271Z"},"datePublic":"2025-06-24T00:00:00.000Z","x_redhatCweChain":"CWE-295: Improper Certificate Validation","workarounds":[{"lang":"en","value":"Download the VM image manually with another tool that verifies the TLS certificate and then pass the local image as a file path to podman, for example:\n\n# podman machine init --image <local-image-path>"}],"timeline":[{"lang":"en","time":"2025-06-12T15:14:34.557Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-06-24T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Paul Holzinger (Red Hat Inc.)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-24T14:11:17.749372Z","id":"CVE-2025-6032","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-24T14:12:10.372Z"}}]}}}