CVE-2025-6032

Published Jun 24, 2025

Last updated 10 days ago

CVSS high 8.3
Container Security

Overview

Description
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
Source
secalert@redhat.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.3
Impact score
6
Exploitability score
1.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity
HIGH

Weaknesses

secalert@redhat.com
CWE-295

Social media

Hype score
Not currently trending

  1. 🚨 Critical #Podman flaw: CVE-2025-6032 (CVSS 9.0) lets attackers bypass TLS cert verification. ⚠️ Impacts: @openSUSE Leap 15.3, @SUSE Enterprise Storage, SLES. 🔧 PATCH: zypper in -t patch SUSE-2025-2806=1 Read more: 👉 https://t.co/63FiojlsP5 https://t.co/0ObcZWetHH

    @Cezar_H_Linux

    16 Aug 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Podman v5.2.2 just dropped! It mostly addresses CVE-2025-6032, a TLS issue with `podman machine`, and has another smaller fix. Out to Fedora testing now, and other distros shortly! #podman #OpenSource https://t.co/csbb25cLn7

    @Podman_io

    24 Jun 2025

    1359 Impressions

    11 Retweets

    53 Likes

    4 Bookmarks

    0 Replies

    1 Quote

  3. CVE-2025-6032 A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results … https://t.co/0qTGGtie30

    @CVEnew

    24 Jun 2025

    421 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  4. [CVE-2025-6032: HIGH] Critical security flaw in Podman! Vulnerability allows Man In The Middle attack by not verifying TLS certificates when downloading VM images from OCI registry. #CyberSecurity#cve,CVE-2025-6032,#cybersecurity https://t.co/WraUclFMkP https://t.co/Fh8erTjwJn

    @CveFindCom

    24 Jun 2025

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. [CVE-2025-6032: HIGH] Podman machine init command in #cybersecurity flaw! Lack of TLS cert verification in image download from OCI registry leads to potential Man In The Middle attack.#cve,CVE-2025-6032,#cybersecurity https://t.co/WraUclFMkP https://t.co/VnQ79CKD8h

    @CveFindCom

    24 Jun 2025

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2025-14269
  2. The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.•CVE-2026-79994
  3. On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.•CVE-2026-77179
  4. containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.•CVE-2026-53495
  5. A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.•CVE-2026-78234

References

Sources include official advisories and independent security research.