CVE-2025-6032
Vulnerability Summary
Timeline
Description
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVSS Metrics
- v3.1•HIGH•Score: 8.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 0.48%• Percentile: 41%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- chainguard•prometheus-podman-exporter
< 1.17.1-r1
- chainguard•prometheus-podman-exporter-fips
< 1.17.1-r1
- debian•podman
< 5.4.2+ds1-2 | < 5.4.2+ds1-2
- github.com/containers•podman
all
- github.com/containers/podman•v2
all
- github.com/containers/podman•v3
all
- github.com/containers/podman•v4
≥ 4.8.0 | ≥ 4.8.0, ≤ 4.9.5
- github.com/containers/podman•v5
< 5.5.2
- redhat•aardvark-dns
< 2:1.10.1-2.module+el8.10.0+23320+f7205097
- redhat•buildah
< 2:1.33.12-2.module+el8.10.0+23320+f7205097
- redhat•buildah-debuginfo
< 2:1.33.12-2.module+el8.10.0+23320+f7205097
- redhat•buildah-debugsource
< 2:1.33.12-2.module+el8.10.0+23320+f7205097
- redhat•buildah-tests
< 2:1.33.12-2.module+el8.10.0+23320+f7205097
- redhat•buildah-tests-debuginfo
< 2:1.33.12-2.module+el8.10.0+23320+f7205097
- redhat•cockpit-podman
< 0:84.1-1.module+el8.10.0+23320+f7205097
- redhat•conmon
< 3:2.1.10-1.module+el8.10.0+23320+f7205097
- redhat•conmon-debuginfo
< 3:2.1.10-1.module+el8.10.0+23320+f7205097
- redhat•conmon-debugsource
< 3:2.1.10-1.module+el8.10.0+23320+f7205097
- redhat•container-selinux
< 2:2.229.0-2.module+el8.10.0+23320+f7205097
- redhat•containernetworking-plugins
< 1:1.4.0-6.module+el8.10.0+23320+f7205097
- redhat•containernetworking-plugins-debuginfo
< 1:1.4.0-6.module+el8.10.0+23320+f7205097
- redhat•containernetworking-plugins-debugsource
< 1:1.4.0-6.module+el8.10.0+23320+f7205097
- redhat•containers-common
< 2:1-82.module+el8.10.0+23320+f7205097
- redhat•crit
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•criu
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•criu-debuginfo
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•criu-debugsource
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•criu-devel
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•criu-libs
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•criu-libs-debuginfo
< 0:3.18-5.module+el8.10.0+23320+f7205097
- redhat•crun
< 0:1.14.3-2.module+el8.10.0+23320+f7205097
- redhat•crun-debuginfo
< 0:1.14.3-2.module+el8.10.0+23320+f7205097
- redhat•crun-debugsource
< 0:1.14.3-2.module+el8.10.0+23320+f7205097
- redhat•fuse-overlayfs
< 0:1.13-1.module+el8.10.0+23320+f7205097
- redhat•fuse-overlayfs-debuginfo
< 0:1.13-1.module+el8.10.0+23320+f7205097
- redhat•fuse-overlayfs-debugsource
< 0:1.13-1.module+el8.10.0+23320+f7205097
- redhat•libslirp
< 0:4.4.0-2.module+el8.10.0+23320+f7205097
- redhat•libslirp-debuginfo
< 0:4.4.0-2.module+el8.10.0+23320+f7205097
- redhat•libslirp-debugsource
< 0:4.4.0-2.module+el8.10.0+23320+f7205097
- redhat•libslirp-devel
< 0:4.4.0-2.module+el8.10.0+23320+f7205097
- redhat•netavark
< 2:1.10.3-1.module+el8.10.0+23320+f7205097
- redhat•oci-seccomp-bpf-hook
< 0:1.2.10-1.module+el8.10.0+23320+f7205097
- redhat•oci-seccomp-bpf-hook-debuginfo
< 0:1.2.10-1.module+el8.10.0+23320+f7205097
- redhat•oci-seccomp-bpf-hook-debugsource
< 0:1.2.10-1.module+el8.10.0+23320+f7205097
- redhat•podman
< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
- redhat•podman-catatonit
< 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-14.rhaos4.16.el8
- redhat•podman-catatonit-debuginfo
< 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-14.rhaos4.16.el8
- redhat•podman-debuginfo
< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
- redhat•podman-debugsource
< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
- redhat•podman-docker
< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
Showing first 50 affected entries in server-rendered view.
References (33)
- https://access.redhat.com/errata/RHSA-2025:10295
- https://access.redhat.com/errata/RHSA-2025:10549
- https://access.redhat.com/errata/RHSA-2025:10550
- https://access.redhat.com/errata/RHSA-2025:10551
- https://access.redhat.com/errata/RHSA-2025:10668
- https://access.redhat.com/errata/RHSA-2025:11359
- https://access.redhat.com/errata/RHSA-2025:11363
- https://access.redhat.com/errata/RHSA-2025:11677
- https://access.redhat.com/errata/RHSA-2025:11681
- https://access.redhat.com/errata/RHSA-2025:15397
- https://access.redhat.com/errata/RHSA-2025:9726
- https://access.redhat.com/errata/RHSA-2025:9751
- https://access.redhat.com/errata/RHSA-2025:9766
- https://access.redhat.com/security/cve/CVE-2025-6032
- https://bugzilla.redhat.com/show_bug.cgi?id=2372501
- https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3
- https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h
- https://nvd.nist.gov/vuln/detail/CVE-2025-6032
- https://github.com/containers/podman
- https://security-tracker.debian.org/tracker/CVE-2025-6032
- https://access.redhat.com/security/updates/classification/#important
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10549.json
- https://www.cve.org/CVERecord?id=CVE-2025-6032
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10550.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10551.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10668.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9726.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9751.json
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9766.json
- https://access.redhat.com/downloads/content/package-browser/
- https://catalog.redhat.com/software/containers/
- https://github.com/containers/podman/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6032.json