CVE-2025-6032
BaseFortify
Publication date: 2025-06-24
Last updated on: 2025-11-29
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Podman involves the 'podman machine init' command failing to verify the TLS certificate when downloading VM images from an OCI registry. Because the TLS certificate is not verified, an attacker with network access between the client and the registry can perform a Man-In-The-Middle (MITM) attack, intercepting or manipulating the downloaded images. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker to intercept and manipulate VM images downloaded by Podman, potentially leading to the execution of malicious code, compromise of system integrity, and unauthorized access. This can severely impact the security of systems running affected Podman versions, especially in environments relying on these VM images. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying Podman versions 4.8.0 and later where the `podman machine init` command downloads VM images without TLS certificate verification. You can check the Podman version installed using the command `podman --version`. Additionally, monitoring network traffic for unverified TLS connections to OCI registries could help detect exploitation attempts. Specific commands to detect MITM attacks are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Podman to a version where this vulnerability is fixed (a version later than those affected, i.e., later than 5.0.0). Restrict network access to OCI registries to trusted networks to prevent MITM attacks. Since the vulnerability arises from lack of TLS verification during image download, ensuring secure network paths or disabling automatic image downloads until patched can reduce risk. [1]