CVE-2025-6032

Impact

The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.

Patches

https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2

Workarounds

Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.(CVE-2025-6032)

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman

These are all security issues fixed in the podman-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.

This update for podman fixes the following issues:

Changes in podman:

• Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

• CVE-2025-47914: Fixed golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253993)

• CVE-2025-47913: Fixed golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253542):

• CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed runc: Container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1252376):

• CVE-2025-9566: Fixed that podman kube play command may overwrite host files (bsc#1249154):

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for podman fixes the following issues:

• CVE-2025-6032: Fixed machine init command failing to verify TLS certificate (bsc#1245320)

This update for podman fixes the following issues:

• CVE-2025-6032: Fixed machine init command failing to verify TLS certificate (bsc#1245320)

This update for podman fixes the following issues:

• CVE-2025-6032: Fixed machine init command failing to verify TLS certificate (bsc#1245320)

This update for podman fixes the following issues:

• CVE-2025-6032: Machine init command fails to verify TLS certificate when downloading VM images from an OCI registry (bsc#1245320).

This update for podman fixes the following issues:

• CVE-2025-6032: Fixed machine init command failing to verify TLS certificate (bsc#1245320)

• Fix conditional Requires (remove deprecated sle_version macro)

• Update to version 5.4.2:

  • Add release notes for v5.4.2
  • Fix a potential deadlock during podman cp
  • Improve the file format documentation of podman-import.
  • Revert "podman-import only supports gz and tar"
  • Bump buildah to v1.39.4
  • libpod: do not cover idmapped mountpoint
  • test: Fix runc error message
  • oci: report empty exec path as ENOENT
  • test: adapt tests new crun error messages
  • test: remove duplicate test
  • cirrus: test only on f41/rawhide
  • CI: use z1d instance for windows machine testing
  • New images 2025-03-24
  • test/e2e: use go net.Dial() ov nc
  • test: use ncat over nc
  • New images 2025-03-12
  • RPM: Add riscv64 to ExclusiveArch-es
  • Fix HealthCheck log destination, count, and size defaults
  • Win installer test: hardcode latest GH release ID
  • Packit: Fix action script for fetching upstream commit
  • Bump to v5.4.2-dev
  • Bump to v5.4.1
  • update gvproxy version to 0.8.4
  • Update Buildah to v1.39.2
  • Update release notes for v5.4.1
  • Fix reporting summed image size for compat endpoint
  • podman-import only supports gz and tar
  • quadlet kube: correctly mark unit as failed
  • pkg/domain/infra/abi/play.go: fix two nilness issues
  • kube play: don't print start errors twice
  • libpod: race in WaitForConditionWithInterval()
  • libpod: race in WaitForExit() with autoremove
  • Don't try to resolve host path if copying to container from stdin.
  • Use svg for pkginstaller banner
  • Create quota before _data dir for volumes
  • Packit: clarify secondary status in CI
  • Packit/RPM: Display upstream commit SHA in all rpm builds
  • podman run: fix --pids-limit -1 wrt runc
  • vendor: update github.com/go-jose/go-jose/v3 to v3.0.4
  • chore(deps): update module github.com/go-jose/go-jose/v4 to v4.0.5 [security]
  • wire up --retry-delay for artifact pull
  • Revert "silence false positve from golangci-lint"
  • update golangci-lint to v1.64.4
  • update golangci-lint to v1.64.2
  • silence false positve from golangci-lint
  • cmd/podman: refactor Context handling
  • fix new usetesting lint issue
  • Packit/Copr: Fix podman version in rpm
  • Remove persist directory when cleaning up Conmon files
  • Bump to v5.4.1-dev
  • Bump to v5.4.0
  • Update release notes for v5.4.0 final
  • In SQLite state, use defaults for empty-string checks
  • Bump FreeBSD version to 13.4
  • docs: add v5.4 to API reference
  • Update rpm/podman.spec
  • RPM: set buildOrigin in LDFLAG
  • RPM: cleanup macro defs
  • Makefile: escape BUILD_ORIGIN properly
  • rootless: fix hang on s390x
  • Set Cirrus DEST_BRANCH appropriately to fix CI
  • Bump to v5.4.0-dev
  • Bump to v5.4.0-rc3
  • Update release notes for v5.4.0-rc3
  • Add BuildOrigin field to podman info
  • artifact: only allow single manifest
  • test/e2e: improve write/removeConf()
  • Add --noheading to artifact ls
  • Add --no-trunc to artifact ls
  • Add type and annotations to artifact add
  • pkg/api: honor cdi devices from the hostconfig
  • util: replace Walk with WalkDir
  • fix(pkg/rootless): avoid memleak during init() contructor.
  • Add machine init --playbook
  • RPM: include empty check to silence rpmlint
  • RPM: adjust qemu dependencies
  • Force use of iptables on Windows WSL
  • rpm: add attr as dependency for podman-tests
  • update gvproxy version
  • [v5.4] Bump Buildah to v1.39.0
  • podman exec: correctly support detaching
  • libpod: remove unused ExecStartAndAttach()
  • [v5.4] Bump c/storage to v1.57.1, c/image v5.34.0, c/common v0.62.0
  • Move detection of libkrun and intel
  • Prevent two podman machines running on darwin
  • Remove unnecessary error handling
  • Remove usused Kind() function
  • Bump to v5.4.0-dev
  • Bump to v5.4.0-rc2
  • Update release notes for v5.4.0-rc2 …

This update for podman fixes the following issues:

• CVE-2025-9566: Fixed kube play command overwriting host files (bsc#1249154)

This update for podman fixes the following issues:

Changes in podman:

• Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

• CVE-2025-47914: Fixed golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253993)

• CVE-2025-47913: Fixed golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253542):

• CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed runc: Container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1252376):

• CVE-2025-9566: Fixed that podman kube play command may overwrite host files (bsc#1249154):

This update for podman fixes the following issues:

Changes in podman:

• Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

• CVE-2025-47914: Fixed golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253993)

• CVE-2025-47913: Fixed golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253542):

• CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed runc: Container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files (bsc#1252376):

• CVE-2025-9566: Fixed that podman kube play command may overwrite host files (bsc#1249154):

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for podman fixes the following issues

• CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262856).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266125).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266125).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266125).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266125).

This update for podman fixes the following issues:

• CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579).
• CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).