CVE-2025-6032

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

References

Affected packages

Debian:13 / podman

Package

Name: podman
Purl: pkg:deb/debian/podman?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.2.2+ds1-3

5.2.2+ds1-4

5.2.3+ds1-1

5.2.3+ds1-2

5.2.3+ds1-3

5.2.3+ds1-4

5.2.4+ds1-1

5.2.5-1

5.3.0+ds1-1

5.3.0+ds1-2

5.3.0+ds1-3

5.3.1+ds1-1

5.3.1+ds1-2

5.3.1+ds1-3

5.3.1+ds1-4

5.3.1+ds1-5

5.3.1+ds1-6

5.3.1+ds1-7

5.3.2+ds1-1

5.4.0+ds1-1

5.4.1+ds1-1

5.4.1+ds1-2

5.4.1+ds1-3

5.4.2+ds1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}