CVE-2025-6032

Published: Jun 24, 2025

Modified: Nov 29, 2025

PUBLISHED

CVSS v3.1

8.3

HIGH

Description

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Vendor	Product	Versions
Unknown	podman	affected `4.8.0 - < 5.5.2`
Red Hat	Red Hat Enterprise Linux 10	unaffected `6:5.4.0-12.el10_0 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `8100020250625105344.afee755d - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `5:5.4.0-12.el9_6 - < *`
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected `4:4.9.4-18.el9_4.2 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.16	unaffected `4:4.9.4-16.rhaos4.16.el9 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.16	unaffected `416.94.202507222002-0 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.17	unaffected `5:5.2.2-8.rhaos4.17.el9 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.17	unaffected `417.94.202507132309-0 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.18	unaffected `418.94.202507221927-0 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.18	unaffected `5:5.2.2-9.rhaos4.18.el9 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.19	unaffected `4.19.9.6.202507152218-0 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.19	unaffected `5:5.4.0-6.rhaos4.19.el9 - < *`
Red Hat	Red Hat OpenShift Container Platform 4.20	unaffected `4.20.9.6.202509251656-0 - < *`
Red Hat	Red Hat OpenShift Container Platform 4	All versions