Podman: podman missing tls verification

Summary

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Timeline

1. Jun 24, 2025, 1:50 PM UTCCVE published
2. Jun 24, 2025, 2:11 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 12, 2026, 7:53 PM UTCRecord last updated

Affected versions

• podman

  From 4.8.0 · fixed in 5.5.2

• podman

  Version range not reported

• container-tools:rhel8

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• github.com/containers/podman/v4Go

  From 4.8.0 · through 4.9.5

• github.com/containers/podman/v5Go

  fixed in 5.5.2

• github.com/containers/podmanGo

  All versions

• github.com/containers/podman/v2Go

  All versions

• github.com/containers/podman/v3Go

  All versions

• github.com/containers/podman/v4Go

  From 4.8.0

References 17