CVE-2025-6032: Podman Improper Certificate Validation; machine missing TLS verification
(updated )
The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.
References
- access.redhat.com/errata/RHSA-2025:10295
- access.redhat.com/errata/RHSA-2025:10549
- access.redhat.com/errata/RHSA-2025:10550
- access.redhat.com/errata/RHSA-2025:10551
- access.redhat.com/errata/RHSA-2025:10668
- access.redhat.com/errata/RHSA-2025:11359
- access.redhat.com/errata/RHSA-2025:11363
- access.redhat.com/errata/RHSA-2025:11677
- access.redhat.com/errata/RHSA-2025:11681
- access.redhat.com/errata/RHSA-2025:15397
- access.redhat.com/errata/RHSA-2025:9726
- access.redhat.com/errata/RHSA-2025:9751
- access.redhat.com/errata/RHSA-2025:9766
- access.redhat.com/security/cve/CVE-2025-6032
- bugzilla.redhat.com/show_bug.cgi?id=2372501
- github.com/advisories/GHSA-65gg-3w2w-hr4h
- github.com/containers/podman
- github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3
- github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h
- nvd.nist.gov/vuln/detail/CVE-2025-6032
Code Behaviors & Features
Detect and mitigate CVE-2025-6032 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →