GHSA-65gg-3w2w-hr4hPublished

Podman: podman missing tls verification

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2025-6032

Published

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Source published: 24 Jun 2025 13:50:47 UTC
Source modified: 12 Oct 2026 19:53:07 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

euvd · EUVD-2025-19013

Published

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 24, 2025, 1:50:47 PM

dateUpdated: Oct 12, 2026, 7:53:07 PM

31 related source bulletins · separate from aliases

RHSA-2025:11677: Red Hat Security Advisory: OpenShift Container Platform 4.18.21 bug fix and security update

CVE-2024-45339 · CVE-2025-6032 · CVE-2025-48060

RHSA-2025:10295: Red Hat Security Advisory: OpenShift Container Platform 4.17.35 packages and security update

CVE-2025-6032 · CVE-2025-22871

RHSA-2025:11363: Red Hat Security Advisory: OpenShift Container Platform 4.19.5 bug fix and security update

CVE-2025-6032 · CVE-2025-48060

SUSE-SU-2026:22451-1: Security update for podman

CVE-2025-22869 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-52881 · CVE-2025-6032 · CVE-2025-9566 · CVE-2026-34986 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

RHSA-2025:15397: Red Hat Security Advisory: OpenShift Container Platform 4.20.0 bug fix and security update

CVE-2025-5914 · CVE-2025-5994 · CVE-2025-6032 · CVE-2025-6965 · CVE-2025-49794 · CVE-2025-49796

msrc_CVE-2025-6032: Podman: podman missing tls verification

CVE-2025-6032

SUSE-SU-2026:22516-1: Security update for podman

CVE-2024-6104 · CVE-2025-22869 · CVE-2025-27144 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-52881 · CVE-2025-6032 · CVE-2025-9566 · CVE-2026-34986 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-42508 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598

SUSE-SU-2026:20641-1: Security update for podman

CVE-2025-22869 · CVE-2025-31133 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-52565 · CVE-2025-52881 · CVE-2025-6032 · CVE-2025-9566

RHSA-2025:9766: Red Hat Security Advisory: OpenShift Container Platform 4.16.43 packages and security update

CVE-2025-6032

SUSE-SU-2025:20805-1: Security update for podman

CVE-2025-6032

SUSE-SU-2025:02806-1: Security update for podman

CVE-2025-6032

RHSA-2025:10550: Red Hat Security Advisory: podman security update

CVE-2025-6032

SUSE-SU-2025:02807-1: Security update for podman

CVE-2025-6032

WID-SEC-W-2025-1389: Podman: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

CVE-2025-6032

WID-SEC-W-2025-2043: IBM QRadar SIEM: Mehrere Schwachstellen

CVE-2021-47670 · CVE-2023-49083 · CVE-2024-56644 · CVE-2025-21727 · CVE-2025-21759 · CVE-2025-22058 · CVE-2025-22097 · CVE-2025-37914 · CVE-2025-38085 · CVE-2025-38159 · CVE-2025-38200 · CVE-2025-38250 · CVE-2025-38380 · CVE-2025-5914 · CVE-2025-5994 · CVE-2025-6020 · CVE-2025-6032 · CVE-2025-8194 · CVE-2025-0164

openSUSE-SU-2026:20305-1: Security update for podman

CVE-2025-22869 · CVE-2025-31133 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-52565 · CVE-2025-52881 · CVE-2025-6032 · CVE-2025-9566

openSUSE-SU-2025:15405-1: govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

CVE-2024-44905 · CVE-2024-44906 · CVE-2024-56731 · CVE-2025-0928 · CVE-2025-1088 · CVE-2025-30086 · CVE-2025-32019 · CVE-2025-3227 · CVE-2025-3228 · CVE-2025-3415 · CVE-2025-4563 · CVE-2025-4656 · CVE-2025-46702 · CVE-2025-4674 · CVE-2025-47281 · CVE-2025-47871 · CVE-2025-47943 · CVE-2025-4922 · CVE-2025-4981 · CVE-2025-49825 · CVE-2025-5030 · CVE-2025-51471 · CVE-2025-52477 · CVE-2025-52889 · CVE-2025-52890 · CVE-2025-52893 · CVE-2025-52894 · CVE-2025-52900 · CVE-2025-52901 · CVE-2025-52902 · CVE-2025-52903 · CVE-2025-52904 · CVE-2025-52995 · CVE-2025-52996 · CVE-2025-52997 · CVE-2025-53512 · CVE-2025-53513 · CVE-2025-53547 · CVE-2025-53632 · CVE-2025-53633 · CVE-2025-53634 · CVE-2025-53826 · CVE-2025-53893 · CVE-2025-53945 · CVE-2025-54059 · CVE-2025-54379 · CVE-2025-5689 · CVE-2025-5981 · CVE-2025-6023 · CVE-2025-6032 · CVE-2025-6224 · CVE-2025-6226 · CVE-2025-6227 · CVE-2025-6233 · CVE-2025-6264 · CVE-2025-6624

RHSA-2025:10668: Red Hat Security Advisory: podman security update

CVE-2025-6032

RHSA-2025:9751: Red Hat Security Advisory: OpenShift Container Platform 4.19.2 packages and security update

CVE-2025-6032

SUSE-SU-2025:20869-1: Security update for podman

CVE-2024-6104 · CVE-2025-22869 · CVE-2025-27144 · CVE-2025-6032 · CVE-2025-9566

SUSE-SU-2025:20692-1: Security update for podman

CVE-2025-6032

RHSA-2025:11359: Red Hat Security Advisory: OpenShift Container Platform 4.17.36 bug fix and security update

CVE-2025-6032

SUSE-SU-2026:20626-1: Security update for podman

CVE-2025-22869 · CVE-2025-31133 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-52565 · CVE-2025-52881 · CVE-2025-6032 · CVE-2025-9566

openSUSE-SU-2026:21244-1: Security update for podman

RHSA-2025:11681: Red Hat Security Advisory: OpenShift Container Platform 4.16.45 bug fix and security update

CVE-2024-45339 · CVE-2024-51744 · CVE-2025-6032 · CVE-2025-30204 · CVE-2025-48060

openSUSE-SU-2025:15262-1: podman-5.5.2-1.1 on GA media

CVE-2025-6032

RHSA-2025:10551: Red Hat Security Advisory: container-tools:rhel8 security update

CVE-2025-6032

SUSE-SU-2026:24378-1: Security update for podman

CVE-2025-22869 · CVE-2025-47913 · CVE-2025-47914 · CVE-2025-52881 · CVE-2025-6032 · CVE-2025-9566 · CVE-2026-34986 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-42508 · CVE-2026-55686 · CVE-2026-57231

RHSA-2025:10549: Red Hat Security Advisory: podman security update

CVE-2025-6032

RHSA-2025:9726: Red Hat Security Advisory: OpenShift Container Platform 4.18.19 packages and security update

CVE-2025-6032

SUSE-SU-2025:02808-1: Security update for podman

CVE-2025-6032

Source published: Jun 24, 2025, 1:50:47 PM (timezone not stated)
Source modified: Oct 12, 2026, 7:53:07 PM (timezone not stated)
Observed here: 9 Nov 2026 04:03:54 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

nvd · CVE-2025-6032

Published

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-295

Original publisher date fields

published: 2025-06-24T14:15:30.703

lastModified: 2026-10-12T20:17:07.103

Source published: 24 Jun 2025 14:15:30 UTC
Source modified: 12 Oct 2026 20:17:07 UTC
Observed here: 25 Oct 2026 03:17:27 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

osv · GHSA-65gg-3w2w-hr4h

Published

### Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack. ### Patches https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2 ### Workarounds Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)

Source published: 25 Jun 2025 21:57:00 UTC
Source modified: 10 Sep 2026 03:50:24 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Publisher rating · HIGH

osv · GO-2025-3777

Published

Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman

Source published: 28 Jul 2025 19:57:13 UTC
Source modified: 4 Feb 2026 02:15:34 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.