A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criuUpgrade cockpit-podmanUpgrade python3-podmanUpgrade podman-dockerUpgrade podman-catatonitUpgrade podman-testsUpgrade udicaUpgrade podman-gvproxyUpgrade container-selinuxUpgrade buildahUpgrade critUpgrade conmonUpgrade toolbox-testsUpgrade buildah-testsUpgrade libslirpUpgrade slirp4netnsUpgrade crunUpgrade fuse-overlayfsUpgrade netavarkUpgrade toolboxUpgrade aardvark-dnsUpgrade containers-commonUpgrade criu-libsUpgrade podman-pluginsUpgrade python3-criuUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade skopeoUpgrade podmanUpgrade skopeo-testsUpgrade podman-remoteUpgrade runc | Jul 10, 2025 | Jun 24, 2025 |
| Debian | — | Upgrade podman | Jun 26, 2025 | Jun 24, 2025 |
| Freebsd | — | Upgrade podman | Jul 1, 2025 | Jun 30, 2025 |
| Oracle_linux | — | Upgrade fuse-overlayfsUpgrade udicaUpgrade python3-podmanUpgrade buildahUpgrade podman-testsUpgrade container-selinuxUpgrade libslirpUpgrade aardvark-dnsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade conmonUpgrade crunUpgrade podman-dockerUpgrade cockpit-podmanUpgrade python3-criuUpgrade slirp4netnsUpgrade criuUpgrade podman-remoteUpgrade libslirp-develUpgrade criu-libsUpgrade skopeo-testsUpgrade netavarkUpgrade criu-develUpgrade containers-commonUpgrade podman-catatonitUpgrade podmanUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade critUpgrade runc | Jul 9, 2025 | Jun 24, 2025 |
| Redhat Openshift | — | Upgrade rhcosUpgrade podman | Aug 10, 2026 | Jun 24, 2025 |
| Redhat_linux | — | Upgrade toolbox-debuginfoUpgrade critUpgrade crunUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade conmon-debuginfoUpgrade podman-pluginsUpgrade podman-testsUpgrade container-selinuxUpgrade criu-libs-debuginfoUpgrade skopeo-testsUpgrade criu-develUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-dockerUpgrade podman-gvproxy-debuginfoUpgrade buildah-debugsourceUpgrade podman-tests-debuginfoUpgrade podman-remoteUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-criuUpgrade runcUpgrade udicaUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade podmanUpgrade toolbox-testsUpgrade netavarkUpgrade containernetworking-plugins-debugsourceUpgrade toolboxUpgrade containers-commonUpgrade libslirp-develUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade fuse-overlayfsUpgrade buildahUpgrade criu-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade libslirpUpgrade python3-podmanUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade criuUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade buildah-testsUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade skopeoUpgrade podman-gvproxyUpgrade runc-debugsourceUpgrade podman-catatonitUpgrade cockpit-podmanUpgrade buildah-debuginfo | Jul 9, 2025 | Jun 24, 2025 |
| Rocky_linux | — | Upgrade podman-pluginsUpgrade criu-develUpgrade podman-debugsourceUpgrade crun-debuginfoUpgrade podmanUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonitUpgrade podman-testsUpgrade podman-remote-debuginfoUpgrade netavarkUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade libslirpUpgrade criuUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade podman-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade libslirp-debugsourceUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade skopeoUpgrade skopeo-testsUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolboxUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade buildah-testsUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade conmon-debuginfoUpgrade python3-criuUpgrade podman-remoteUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade containers-commonUpgrade toolbox-debuginfoUpgrade runc-debugsourceUpgrade runcUpgrade podman-debuginfoUpgrade criu-libsUpgrade critUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade toolbox-debugsourceUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debuginfoUpgrade buildahUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsource | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade govulncheck-vulndbUpgrade podmanshUpgrade podman-dockerUpgrade podman-remoteUpgrade podman | Aug 19, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub