A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVSS Details
- CVSS 3.1 Base Score: 8.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade podman-dockerUpgrade crunUpgrade buildahUpgrade slirp4netnsUpgrade libslirpUpgrade toolbox-testsUpgrade podman-gvproxyUpgrade udicaUpgrade buildah-testsUpgrade container-selinuxUpgrade critUpgrade cockpit-podmanUpgrade criuUpgrade python3-podmanUpgrade podman-testsUpgrade fuse-overlayfsUpgrade conmonUpgrade aardvark-dnsUpgrade podmanUpgrade containers-commonUpgrade criu-develUpgrade podman-pluginsUpgrade podman-remoteUpgrade runcUpgrade toolboxUpgrade containernetworking-pluginsUpgrade skopeoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade skopeo-testsUpgrade criu-libsUpgrade python3-criuUpgrade netavark | Jul 10, 2025 | Jun 24, 2025 |
| Debian | — | Upgrade podmanNo solution exists | Jun 26, 2025 | Jun 24, 2025 |
| Freebsd | — | Upgrade podman | Jul 1, 2025 | Jun 30, 2025 |
| Oracle_linux | — | Upgrade runcUpgrade critUpgrade podman-catatonitUpgrade criu-develUpgrade netavarkUpgrade containernetworking-pluginsUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade containers-commonUpgrade libslirp-develUpgrade criuUpgrade podman-remoteUpgrade criu-libsUpgrade skopeo-testsUpgrade podman-pluginsUpgrade python3-criuUpgrade buildahUpgrade fuse-overlayfsUpgrade udicaUpgrade libslirpUpgrade conmonUpgrade podman-dockerUpgrade cockpit-podmanUpgrade python3-podmanUpgrade crunUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade container-selinuxUpgrade aardvark-dns | Jul 9, 2025 | Jun 24, 2025 |
| Redhat Openshift | — | Upgrade podmanUpgrade rhcos | Aug 10, 2026 | Jun 24, 2025 |
| Redhat_linux | — | Upgrade python3-criuUpgrade libslirp-debugsourceUpgrade criu-develUpgrade container-selinuxUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfoUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade containernetworking-pluginsUpgrade podman-testsUpgrade podman-tests-debuginfoUpgrade skopeo-testsUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debugsourceUpgrade runc-debuginfoUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade udicaUpgrade crunUpgrade runcUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade toolboxUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade skopeoUpgrade podman-gvproxyUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade podman-catatonitUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade conmonUpgrade buildah-tests-debuginfoUpgrade python3-podmanUpgrade libslirpUpgrade slirp4netnsUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade containers-commonUpgrade netavarkUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfsUpgrade buildahUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade buildah-tests | Jul 9, 2025 | Jun 24, 2025 |
| Rocky_linux | — | Upgrade buildah-testsUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade containers-commonUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade toolbox-testsUpgrade python3-criuUpgrade buildah-tests-debuginfoUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade criu-libs-debuginfoUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade crun-debugsourceUpgrade podman-remoteUpgrade conmon-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade critUpgrade criu-libsUpgrade libslirp-develUpgrade conmon-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade crunUpgrade runc-debuginfoUpgrade libslirp-debugsourceUpgrade podman-catatonitUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debugsourceUpgrade skopeo-testsUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade netavarkUpgrade crun-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-develUpgrade podman-pluginsUpgrade podman-debugsourceUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade skopeoUpgrade podman-tests-debuginfo | Feb 5, 2026 | Jul 29, 2025 |
| Suse | — | Upgrade podmanshUpgrade govulncheck-vulndbUpgrade podmanUpgrade podman-remoteUpgrade podman-docker | Aug 19, 2025 | Jul 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub