A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
| Version | Base score | Base severity | Vector |
|---|---|---|---|
| 3.1 | 8.3 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| CAPEC ID | Description |
|---|
Download the VM image manually with another tool that verifies the TLS certificate and then pass the local image as a file path to podman, for example: # podman machine init --image <local-image-path>
| Event | Date |
|---|---|
| Reported to Red Hat. | 2025-06-12 15:14:34 |
| Made public. | 2025-06-24 00:00:00 |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|