A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade skopeoUpgrade criu-libsUpgrade libslirp-develUpgrade containers-commonUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade toolboxUpgrade podmanUpgrade runcUpgrade podman-remoteUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade podman-dockerUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade buildahUpgrade container-selinuxUpgrade udicaUpgrade critUpgrade buildah-testsUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade libslirpUpgrade conmonUpgrade crunUpgrade slirp4netnsUpgrade podman-testsUpgrade fuse-overlayfsUpgrade criuUpgrade python3-podman | Jul 10, 2025 | Jun 24, 2025 |
| Debian | — | Upgrade podman | Jun 26, 2025 | Jun 24, 2025 |
| Freebsd | — | Upgrade podman | Jul 1, 2025 | Jun 30, 2025 |
| Oracle_linux | — | Upgrade libslirpUpgrade aardvark-dnsUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade udicaUpgrade slirp4netnsUpgrade conmonUpgrade python3-criuUpgrade container-selinuxUpgrade buildahUpgrade buildah-testsUpgrade podman-gvproxyUpgrade podman-testsUpgrade crunUpgrade cockpit-podmanUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade critUpgrade containers-commonUpgrade podman-pluginsUpgrade skopeo-testsUpgrade criu-libsUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade netavarkUpgrade criuUpgrade criu-develUpgrade podman-catatonitUpgrade podmanUpgrade runc | Jul 9, 2025 | Jun 24, 2025 |
| Redhat Openshift | — | Upgrade podmanUpgrade rhcos | Aug 10, 2026 | Jun 24, 2025 |
| Redhat_linux | — | Upgrade podmanUpgrade buildahUpgrade conmon-debugsourceUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade slirp4netnsUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade libslirpUpgrade criuUpgrade crun-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade runc-debugsourceUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade containers-commonUpgrade criu-debuginfoUpgrade buildah-testsUpgrade criu-libsUpgrade python3-podmanUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade skopeo-testsUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade criu-develUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crunUpgrade toolbox-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-dockerUpgrade podman-gvproxy-debuginfoUpgrade buildah-debugsourceUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debuginfoUpgrade runcUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade critUpgrade toolbox-debuginfoUpgrade podman-tests-debuginfoUpgrade podman-testsUpgrade libslirp-debuginfoUpgrade udicaUpgrade container-selinuxUpgrade podman-plugins-debuginfoUpgrade podman-plugins | Jul 9, 2025 | Jun 24, 2025 |
| Rocky_linux | — | Upgrade podman-debugsourceUpgrade podman-testsUpgrade libslirp-debugsourceUpgrade podman-tests-debuginfoUpgrade conmonUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade crunUpgrade skopeoUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade criuUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade criu-develUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podmanUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netnsUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade buildah-testsUpgrade criu-debugsourceUpgrade podman-remoteUpgrade crun-debugsourceUpgrade python3-criuUpgrade buildahUpgrade toolbox-testsUpgrade toolbox-debuginfoUpgrade conmon-debuginfoUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade slirp4netns-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirp-develUpgrade critUpgrade conmon-debugsourceUpgrade criu-libsUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade runcUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade toolbox-debugsourceUpgrade runc-debugsource | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade podmanshUpgrade govulncheck-vulndbUpgrade podman-dockerUpgrade podmanUpgrade podman-remote | Aug 19, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub