CVE-2025-6032: Podman: podman missing tls verification

Deferred

AliasesSUSE-SU-2025:02806-1SUSE-SU-2025:02807-1SUSE-SU-2025:02808-1+18 more

Published 24-06-2025Last modified 12-10-2026

Vulnerability summary

CVE-2025-6032 is a high (CVSS 8.3) Improper Certificate Validation vulnerability in podman. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.3/10

010

High · v3.1 (CVE.org)

EPSS score

0.52%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 11

OPENSUSE-SU-2025:15405-1 OPENSUSE-SU-2026:20305-1 OPENSUSE-SU-2026:21244-1 RHSA-2025:10295 SUSE-SU-2025:20869-1 SUSE-SU-2026:20626-1+6 more

Timeline

24-06-2025
PublishedVulnerability first disclosed.
12-10-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

CVSS metrics

7 scores · 7 sources · 1 version

v3.18.3

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat66 products

aardvark-dns< 2:1.10.1-2.module+el8.10.0+23320+f7205097
buildah< 2:1.33.12-2.module+el8.10.0+23320+f7205097
buildah-debuginfo< 2:1.33.12-2.module+el8.10.0+23320+f7205097
buildah-debugsource< 2:1.33.12-2.module+el8.10.0+23320+f7205097
buildah-tests< 2:1.33.12-2.module+el8.10.0+23320+f7205097

buildah-tests-debuginfo< 2:1.33.12-2.module+el8.10.0+23320+f7205097
cockpit-podman< 0:84.1-1.module+el8.10.0+23320+f7205097
conmon< 3:2.1.10-1.module+el8.10.0+23320+f7205097
conmon-debuginfo< 3:2.1.10-1.module+el8.10.0+23320+f7205097
conmon-debugsource< 3:2.1.10-1.module+el8.10.0+23320+f7205097
container-selinux< 2:2.229.0-2.module+el8.10.0+23320+f7205097
containernetworking-plugins< 1:1.4.0-6.module+el8.10.0+23320+f7205097
containernetworking-plugins-debuginfo< 1:1.4.0-6.module+el8.10.0+23320+f7205097
containernetworking-plugins-debugsource< 1:1.4.0-6.module+el8.10.0+23320+f7205097
containers-common< 2:1-82.module+el8.10.0+23320+f7205097
crit< 0:3.18-5.module+el8.10.0+23320+f7205097
criu< 0:3.18-5.module+el8.10.0+23320+f7205097
criu-debuginfo< 0:3.18-5.module+el8.10.0+23320+f7205097
criu-debugsource< 0:3.18-5.module+el8.10.0+23320+f7205097
criu-devel< 0:3.18-5.module+el8.10.0+23320+f7205097
criu-libs< 0:3.18-5.module+el8.10.0+23320+f7205097
criu-libs-debuginfo< 0:3.18-5.module+el8.10.0+23320+f7205097
crun< 0:1.14.3-2.module+el8.10.0+23320+f7205097
crun-debuginfo< 0:1.14.3-2.module+el8.10.0+23320+f7205097
crun-debugsource< 0:1.14.3-2.module+el8.10.0+23320+f7205097
fuse-overlayfs< 0:1.13-1.module+el8.10.0+23320+f7205097
fuse-overlayfs-debuginfo< 0:1.13-1.module+el8.10.0+23320+f7205097
fuse-overlayfs-debugsource< 0:1.13-1.module+el8.10.0+23320+f7205097
libslirp< 0:4.4.0-2.module+el8.10.0+23320+f7205097
libslirp-debuginfo< 0:4.4.0-2.module+el8.10.0+23320+f7205097
libslirp-debugsource< 0:4.4.0-2.module+el8.10.0+23320+f7205097
libslirp-devel< 0:4.4.0-2.module+el8.10.0+23320+f7205097
netavark< 2:1.10.3-1.module+el8.10.0+23320+f7205097
oci-seccomp-bpf-hook< 0:1.2.10-1.module+el8.10.0+23320+f7205097
oci-seccomp-bpf-hook-debuginfo< 0:1.2.10-1.module+el8.10.0+23320+f7205097
oci-seccomp-bpf-hook-debugsource< 0:1.2.10-1.module+el8.10.0+23320+f7205097
podman< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-catatonit< 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-14.rhaos4.16.el8
podman-catatonit-debuginfo< 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-14.rhaos4.16.el8
podman-debuginfo< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-debugsource< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-docker< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-gvproxy< 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-14.rhaos4.16.el8
podman-gvproxy-debuginfo< 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-14.rhaos4.16.el8
podman-plugins< 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-plugins-debuginfo< 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-remote< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-remote-debuginfo< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-tests< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 4:4.9.4-22.module+el8.10.0+23320+f7205097 | < 4:4.9.4-18.el9_4.2 | < 5:5.2.2-9.rhaos4.18.el9 | < 5:5.4.0-6.rhaos4.19.el9 | < 4:4.9.4-14.rhaos4.16.el8 | < 4:4.9.4-16.rhaos4.16.el9
podman-tests-debuginfo< 6:5.4.0-12.el10_0 | < 5:5.4.0-12.el9_6 | < 5:5.4.0-6.rhaos4.19.el9
python-podman< 0:4.9.0-3.module+el8.10.0+23320+f7205097
python3-criu< 0:3.18-5.module+el8.10.0+23320+f7205097
python3-podman< 0:4.9.0-3.module+el8.10.0+23320+f7205097
runc< 1:1.1.12-6.module+el8.10.0+23320+f7205097
runc-debuginfo< 1:1.1.12-6.module+el8.10.0+23320+f7205097
runc-debugsource< 1:1.1.12-6.module+el8.10.0+23320+f7205097
skopeo< 2:1.14.5-4.module+el8.10.0+23320+f7205097
skopeo-tests< 2:1.14.5-4.module+el8.10.0+23320+f7205097
slirp4netns< 0:1.2.3-1.module+el8.10.0+23320+f7205097
slirp4netns-debuginfo< 0:1.2.3-1.module+el8.10.0+23320+f7205097
slirp4netns-debugsource< 0:1.2.3-1.module+el8.10.0+23320+f7205097
toolbox< 0:0.0.99.5-2.module+el8.10.0+23320+f7205097
toolbox-debuginfo< 0:0.0.99.5-2.module+el8.10.0+23320+f7205097
toolbox-debugsource< 0:0.0.99.5-2.module+el8.10.0+23320+f7205097
toolbox-tests< 0:0.0.99.5-2.module+el8.10.0+23320+f7205097
udica< 0:0.2.6-21.module+el8.10.0+23320+f7205097

Show all 66

Suse21 products

podman&distro=SUSE Enterprise Storage 7.1< 4.9.5-150300.9.52.1
podman&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 4.9.5-150300.9.52.1
podman&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 4.9.5-150400.4.50.1
podman&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 4.9.5-150400.4.50.1
podman&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 4.9.5-150500.3.46.1

Show all 21

Github.com/containers/podman4 products

v2All versions (No fix recorded)
v3All versions (No fix recorded)
v4≥ 4.8.0, ≤ 4.9.5 | ≥ 4.8.0 (No fix recorded)
v5< 5.5.2

Chainguard2 products

prometheus-podman-exporter< 1.17.1-r1
prometheus-podman-exporter-fips< 1.17.1-r1

Opensuse2 products

podman&distro=openSUSE Leap 15.6< 4.9.5-150500.3.46.1
podman&distro=openSUSE Tumbleweed< 5.5.2-1.1

Debian1 product

podman< 5.4.2+ds1-2

Github.com/containers1 product

podmanAll versions (No fix recorded)

Ubuntu1 product

podmanAll versions (No fix recorded)

8 vendors · 98 products

References

43 links

access.redhat.com/errata/RHSA-2025:10295Vendor AdvisoryX Refsource REDHATWEBAdvisory
access.redhat.com/errata/RHSA-2025:10549Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2025:10550Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2025:10551Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2025:10668Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2025:11359Vendor AdvisoryX Refsource REDHATWEBAdvisory
access.redhat.com/errata/RHSA-2025:11363Vendor AdvisoryX Refsource REDHATWEBAdvisory
access.redhat.com/errata/RHSA-2025:11677Vendor AdvisoryX Refsource REDHATWEBAdvisory
access.redhat.com/errata/RHSA-2025:11681Vendor AdvisoryX Refsource REDHATWEBAdvisory
access.redhat.com/errata/RHSA-2025:15397Vendor AdvisoryX Refsource REDHATWEBAdvisory

Show all 43 references

access.redhat.com/errata/RHSA-2025:9726Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2025:9751Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/errata/RHSA-2025:9766Vendor AdvisoryX Refsource REDHATAdvisoryWEB
access.redhat.com/security/cve/CVE-2025-6032VDB EntryX Refsource REDHATREPORTWEBAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2372501Issue TrackingX Refsource REDHATREPORTWEB
github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3ARTICLEWEBFIX
github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4hARTICLEWEBAdvisory
www.suse.com/support/update/announcement/2025/suse-su-202502806-1/Advisory
bugzilla.suse.com/1245320REPORT
www.suse.com/security/cve/CVE-2025-6032WEB
www.suse.com/support/update/announcement/2025/suse-su-202502807-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202502808-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202520692-1/Advisory
www.suse.com/support/update/announcement/2025/suse-su-202520805-1/Advisory
bugzilla.suse.com/1239088REPORT
bugzilla.suse.com/1242132REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10549.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2025-6032AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2025-6032Advisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10550.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10551.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10668.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9726.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9751.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9766.jsonAdvisory
ubuntu.com/security/CVE-2025-6032REPORT
security-tracker.debian.org/tracker/CVE-2025-6032Advisory
github.com/containers/podmanPACKAGE
access.redhat.com/downloads/content/package-browser/WEB
catalog.redhat.com/software/containers/WEB
github.com/containers/podman/WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6032.jsonAdvisory