{"id":"GHSA-65gg-3w2w-hr4h","revision":"3f1a74fef2cd4fa1868c46f6b4ebc704","records":[{"revision":"3f1a74fef2cd4fa1868c46f6b4ebc704","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-65gg-3w2w-hr4h","aliases":["CVE-2025-6032","GO-2025-3777"],"title":"Podman Improper Certificate Validation; machine missing TLS verification","description":"### Impact\nThe podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.\n\n### Patches\nhttps://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3\nFixed in v5.5.2\n\n### Workarounds\nDownload the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)","state":0,"publishedAt":"2025-06-25T21:57:00+00:00","modifiedAt":"2026-09-10T03:50:24.8870802+00:00","affected":[{"ecosystem":"Go","name":"github.com/containers/podman/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.8.0"},{"kind":"last_affected","version":"4.9.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/containers/podman/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.5.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h","https://nvd.nist.gov/vuln/detail/CVE-2025-6032","https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3","https://github.com/containers/podman","https://bugzilla.redhat.com/show_bug.cgi?id=2372501","https://access.redhat.com/security/cve/CVE-2025-6032","https://access.redhat.com/errata/RHSA-2025:9766","https://access.redhat.com/errata/RHSA-2025:9751","https://access.redhat.com/errata/RHSA-2025:9726","https://access.redhat.com/errata/RHSA-2025:15397","https://access.redhat.com/errata/RHSA-2025:11681","https://access.redhat.com/errata/RHSA-2025:11677","https://access.redhat.com/errata/RHSA-2025:11363","https://access.redhat.com/errata/RHSA-2025:11359","https://access.redhat.com/errata/RHSA-2025:10668","https://access.redhat.com/errata/RHSA-2025:10551","https://access.redhat.com/errata/RHSA-2025:10550","https://access.redhat.com/errata/RHSA-2025:10549","https://access.redhat.com/errata/RHSA-2025:10295"],"sourceUrl":"https://github.com/advisories/GHSA-65gg-3w2w-hr4h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-65gg-3w2w-hr4h","identifiers":["GHSA-65gg-3w2w-hr4h","CVE-2025-6032","GO-2025-3777"]},"retained":false,"historicalAffected":[]}],"coverage":[]}