A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-gvproxyUpgrade buildah-testsUpgrade libslirpUpgrade podman-catatonitUpgrade podman-dockerUpgrade slirp4netnsUpgrade python3-podmanUpgrade cockpit-podmanUpgrade critUpgrade podman-testsUpgrade udicaUpgrade buildahUpgrade container-selinuxUpgrade crunUpgrade toolbox-testsUpgrade conmonUpgrade fuse-overlayfsUpgrade criuUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-pluginsUpgrade libslirp-develUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade podmanUpgrade skopeo-testsUpgrade netavarkUpgrade runcUpgrade criu-develUpgrade podman-remoteUpgrade toolboxUpgrade containers-commonUpgrade aardvark-dnsUpgrade criu-libs | Jul 10, 2025 | Jun 24, 2025 |
| Debian | — | Upgrade podman | Jun 26, 2025 | Jun 24, 2025 |
| Freebsd | — | Upgrade podman | Jul 1, 2025 | Jun 30, 2025 |
| Oracle_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade podmanUpgrade containers-commonUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade podman-pluginsUpgrade critUpgrade skopeo-testsUpgrade skopeoUpgrade criu-libsUpgrade podman-remoteUpgrade runcUpgrade netavarkUpgrade criuUpgrade udicaUpgrade container-selinuxUpgrade conmonUpgrade buildah-testsUpgrade cockpit-podmanUpgrade python3-podmanUpgrade podman-dockerUpgrade crunUpgrade python3-criuUpgrade libslirpUpgrade aardvark-dnsUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade fuse-overlayfsUpgrade buildahUpgrade podman-tests | Jul 9, 2025 | Jun 24, 2025 |
| Redhat Openshift | — | Upgrade podmanUpgrade ose-rhel-coreos | Aug 10, 2026 | Jun 24, 2025 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade criuUpgrade libslirpUpgrade toolboxUpgrade podman-catatonit-debuginfoUpgrade conmonUpgrade libslirp-develUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade containernetworking-plugins-debugsourceUpgrade python3-podmanUpgrade crun-debuginfoUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade skopeoUpgrade buildah-testsUpgrade criu-debuginfoUpgrade criu-libsUpgrade containers-commonUpgrade runc-debugsourceUpgrade podmanUpgrade netavarkUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade toolbox-testsUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade skopeo-testsUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-debugsourceUpgrade podman-dockerUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade udicaUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade critUpgrade slirp4netns-debuginfoUpgrade crunUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirp-debugsourceUpgrade python3-criuUpgrade criu-develUpgrade conmon-debuginfoUpgrade podman-tests-debuginfoUpgrade buildah-debugsourceUpgrade criu-libs-debuginfoUpgrade runcUpgrade podman-testsUpgrade container-selinux | Jul 9, 2025 | Jun 24, 2025 |
| Rocky_linux | — | Upgrade podman-gvproxy-debuginfoUpgrade conmon-debugsourceUpgrade criu-libsUpgrade critUpgrade criu-develUpgrade netavarkUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-tests-debuginfoUpgrade libslirp-debugsourceUpgrade crunUpgrade conmonUpgrade skopeoUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade podman-catatonitUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade conmon-debuginfoUpgrade podman-remoteUpgrade aardvark-dnsUpgrade toolbox-debuginfoUpgrade crun-debugsourceUpgrade buildah-testsUpgrade containers-commonUpgrade libslirp-debuginfoUpgrade containernetworking-pluginsUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade toolbox-testsUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade criu-debuginfoUpgrade criu-libs-debuginfoUpgrade buildah-debuginfoUpgrade runcUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade toolbox-debugsourceUpgrade podman-debuginfo | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade podmanshUpgrade govulncheck-vulndbUpgrade podmanUpgrade podman-remoteUpgrade podman-docker | Aug 19, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub