CVE-2025-6032

Podman: podman missing tls verification

State: Published
Severity: 8.3 High
Published: Jun 24, 2025
Updated: Oct 12, 2026
Reserved: Jun 12, 2025

Description

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	redhat

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
podman	4.8.0 to before 5.5.2Affected
Red Hat Enterprise Linux 10Red Hat	6:5.4.0-12.el10_0 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	8100020250625105344.afee755d and laterNot affected
Red Hat Enterprise Linux 9Red Hat	5:5.4.0-12.el9_6 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat	4:4.9.4-18.el9_4.2 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	4:4.9.4-14.rhaos4.16.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	416.94.202507222002-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	5:5.2.2-8.rhaos4.17.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	417.94.202507132309-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	418.94.202507221927-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	5:5.2.2-9.rhaos4.18.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	4.19.9.6.202507152218-0 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	5:5.4.0-6.rhaos4.19.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	4.20.9.6.202509251656-0 and laterNot affected
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2025:10295vendor-advisory
RHSA-2025:10549vendor-advisory
RHSA-2025:10550vendor-advisory
RHSA-2025:10551vendor-advisory
RHSA-2025:10668vendor-advisory
RHSA-2025:11359vendor-advisory
RHSA-2025:11363vendor-advisory
RHSA-2025:11677vendor-advisory
RHSA-2025:11681vendor-advisory
RHSA-2025:15397vendor-advisory
RHSA-2025:9726vendor-advisory
RHSA-2025:9751vendor-advisory
RHSA-2025:9766vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-6032vdb-entry
RHBZ#2372501issue-tracking
https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3
https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.