CVE-2025-6032: Podman: podman missing tls verification
Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.
Patches https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2
Workarounds Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)
Other sources
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
— NVD
The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.
Requirements to exploit: Access to the network path between registry and client to perform a MITM attack.
Version affected: podman >= 4.8.0 Code was added in commit ea4775e, however it is only used as default way to pull images since 5.0.0.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/containers/podman/v5to a version that resolves this vulnerability.Fixed in 5.5.2 - Upgrade
Upgrade
Podmanto a version that resolves this vulnerability.Fixed in 5.5.2 - Compensating control
Avoid relying on podman machine init’s default OCI registry TLS verification; instead download the disk image manually using another tool that verifies the TLS connection, then pass the local image to podman machine init with --image ./somepath.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6032?
CVE-2025-6032 is considered a high severity vulnerability due to the potential for a Man In The Middle attack.
How do I fix CVE-2025-6032?
To fix CVE-2025-6032, upgrade Podman to version 5.5.2 or later.
Which versions of Podman are affected by CVE-2025-6032?
CVE-2025-6032 affects Podman versions from 4.8.0 up to 4.9.5.
What does CVE-2025-6032 affect in Podman?
CVE-2025-6032 affects the podman machine init command's failure to verify TLS certificates when downloading VM images.
What can happen if CVE-2025-6032 is exploited?
If CVE-2025-6032 is exploited, an attacker could intercept and manipulate VM images in a Man In The Middle attack.