Skip to content
OpenAdvisories

Description

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Affected products

VendorProductAffectedFixed
— podman 4.8.0 – < 5.5.2 5.5.2
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support — —
Red Hat Red Hat OpenShift Container Platform 4.16 — —
Red Hat Red Hat OpenShift Container Platform 4.17 — —
Red Hat Red Hat OpenShift Container Platform 4.18 — —
Red Hat Red Hat OpenShift Container Platform 4.19 — —
Red Hat Red Hat OpenShift Container Platform 4.20 — —
Red Hat Red Hat OpenShift Container Platform 4 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 podman 5.4.2+ds1-2 —
Debian 13 podman 5.4.2+ds1-2 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 podman No fix yet —
Ubuntu 25.10 podman No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 podman +3 6:5.4.0-12.el10_0 RHSA-2025:10549
RHEL 9 podman +4 5:5.4.0-12.el9_6 RHSA-2025:10550
RHEL 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 buildah +1 2:1.33.12-2.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 cockpit-podman 84.1-1.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 conmon 3:2.1.10-1.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 container-selinux 2:2.229.0-2.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 containernetworking-plugins 1:1.4.0-6.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 containers-common 2:1-82.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 crit +4 3.18-5.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 crun 1.14.3-2.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 fuse-overlayfs 1.13-1.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 libslirp +1 4.4.0-2.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 netavark 2:1.10.3-1.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 oci-seccomp-bpf-hook 1.2.10-1.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 podman +6 4:4.9.4-22.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 python-podman +1 4.9.0-3.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 runc 1:1.1.12-6.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 skopeo +1 2:1.14.5-4.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 slirp4netns 1.2.3-1.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 toolbox +1 0.0.99.5-2.module+el8.10.0+23320+f7205097 RHSA-2025:10551
RHEL 8 udica 0.2.6-21.module+el8.10.0+23320+f7205097 RHSA-2025:10551
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS podman +4 4:4.9.4-18.el9_4.2 RHSA-2025:10668
Red Hat OpenShift 4 containernetworking-plugins 1:1.4.0-5.rhaos4.17.el8 RHSA-2025:10295
Red Hat OpenShift 4 cri-o 1.30.14-3.rhaos4.17.git0a197ae.el8 RHSA-2025:10295
Red Hat OpenShift 4 cri-tools 1.30.0-6.el8 RHSA-2025:10295
Red Hat OpenShift 4 podman +6 4:4.9.4-14.rhaos4.16.el8 RHSA-2025:10295, RHSA-2025:9766, RHSA-2025:9751
Red Hat OpenShift 4 skopeo +1 2:1.16.1-2.rhaos4.17.el8 RHSA-2025:10295

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 podman-docker 6:5.4.0-12.el10_0 ALSA-2025:10549
AlmaLinux 9 podman +4 5:5.4.0-12.el9_6 ALSA-2025:10550
AlmaLinux 8 aardvark-dns 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 ALSA-2025:10551
AlmaLinux 8 buildah +1 2:1.33.12-2.module_el8.10.0+4016+efd18bf8 ALSA-2025:10551
AlmaLinux 8 cockpit-podman 84.1-1.module_el8.10.0+4016+efd18bf8 ALSA-2025:10551
AlmaLinux 8 conmon 3:2.1.10-1.module_el8.10.0+3970+8445edf6 ALSA-2025:10551
AlmaLinux 8 container-selinux 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 ALSA-2025:10551
AlmaLinux 8 containernetworking-plugins 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 ALSA-2025:10551
AlmaLinux 8 containers-common 2:1-82.module_el8.10.0+3876+e55593a8 ALSA-2025:10551
AlmaLinux 8 crit 3.18-5.module_el8.10.0+3845+87b84552 ALSA-2025:10551
AlmaLinux 8 criu +1 3.18-5.module_el8.10.0+3876+e55593a8 ALSA-2025:10551
AlmaLinux 8 criu-devel 3.18-5.module_el8.10.0+3858+6ad51f9f ALSA-2025:10551
AlmaLinux 8 criu-libs 3.18-5.module_el8.10.0+3909+6e1c1eb7 ALSA-2025:10551
AlmaLinux 8 crun 1.14.3-2.module_el8.10.0+3845+87b84552 ALSA-2025:10551
AlmaLinux 8 fuse-overlayfs 1.13-1.module_el8.10.0+3792+03eaed9c ALSA-2025:10551
AlmaLinux 8 libslirp 4.4.0-2.module_el8.10.0+3845+87b84552 ALSA-2025:10551
AlmaLinux 8 libslirp-devel 4.4.0-2.module_el8.10.0+3901+4b80ecd7 ALSA-2025:10551
AlmaLinux 8 netavark 2:1.10.3-1.module_el8.10.0+3926+f12484f5 ALSA-2025:10551
AlmaLinux 8 oci-seccomp-bpf-hook 1.2.10-1.module_el8.10.0+3792+03eaed9c ALSA-2025:10551
AlmaLinux 8 podman +6 4:4.9.4-22.module_el8.10.0+4023+db236c53 ALSA-2025:10551
AlmaLinux 8 python3-podman 4.9.0-3.module_el8.10.0+4016+efd18bf8 ALSA-2025:10551
AlmaLinux 8 runc 1:1.1.12-6.module_el8.10.0+3959+b8dc5e6a ALSA-2025:10551
AlmaLinux 8 skopeo +1 2:1.14.5-4.module_el8.10.0+4016+efd18bf8 ALSA-2025:10551
AlmaLinux 8 slirp4netns 1.2.3-1.module_el8.10.0+3876+e55593a8 ALSA-2025:10551
AlmaLinux 8 toolbox 0.0.99.5-2.module_el8.10.0+3845+87b84552 ALSA-2025:10551
AlmaLinux 8 toolbox-tests 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f ALSA-2025:10551
AlmaLinux 8 udica 0.2.6-21.module_el8.10.0+3926+f12484f5 ALSA-2025:10551

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 podman 6:5.4.0-12.el10_0 RLSA-2025:10549
Rocky Linux 9 podman 5:5.4.0-12.el9_6 RLSA-2025:10550
Rocky Linux 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+1874+ce489889 RLSA-2025:10551
Rocky Linux 8 buildah 2:1.33.12-2.module+el8.10.0+2001+6a33db9f RLSA-2025:10551
Rocky Linux 8 cockpit-podman 84.1-1.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 conmon 3:2.1.10-1.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 container-selinux 2:2.229.0-2.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 containernetworking-plugins 1:1.4.0-6.module+el8.10.0+2001+6a33db9f RLSA-2025:10551
Rocky Linux 8 containers-common 2:1-82.module+el8.10.0+1843+6892ab28 RLSA-2025:10551
Rocky Linux 8 criu 3.18-5.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 crun 1.14.3-2.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 fuse-overlayfs 1.13-1.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 libslirp 4.4.0-2.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 netavark 2:1.10.3-1.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 oci-seccomp-bpf-hook 1.2.10-1.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 podman 4:4.9.4-22.module+el8.10.0+2006+320bb1e5 RLSA-2025:10551
Rocky Linux 8 python-podman 4.9.0-3.module+el8.10.0+1896+b18fa106 RLSA-2025:10551
Rocky Linux 8 runc 1:1.1.12-6.module+el8.10.0+1933+1fc610b1 RLSA-2025:10551
Rocky Linux 8 skopeo 2:1.14.5-4.module+el8.10.0+2001+6a33db9f RLSA-2025:10551
Rocky Linux 8 slirp4netns 1.2.3-1.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
Rocky Linux 8 toolbox 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 RLSA-2025:10551
Rocky Linux 8 udica 0.2.6-21.module+el8.10.0+1815+5fe7415e RLSA-2025:10551
ReleasePackageFixed inAdvisory
SLES 15 SP7 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1
SLES 15 SP6 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1
SLES 15 SP5 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1
SLES 15 SP4 podman 4.9.5-150400.4.50.1 SUSE-SU-2025:02807-1
SLES 15 SP3 podman 4.9.5-150300.9.52.1 SUSE-SU-2025:02806-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 podman 5.4.2-160000.4.1 SUSE-SU-2026:20626-1
SLES for SAP 15 SP5 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1
SLES for SAP 15 SP4 podman 4.9.5-150400.4.50.1 SUSE-SU-2025:02807-1
SLES for SAP 15 SP3 podman 4.9.5-150300.9.52.1 SUSE-SU-2025:02806-1
SLES 16.0 podman 5.4.2-160000.4.1 SUSE-SU-2026:20626-1
SLE Micro 6.2 podman 5.4.2-160000.4.1 SUSE-SU-2026:20641-1
SLE Micro 6.1 podman 5.4.2-slfo.1.1_1.1 SUSE-SU-2026:24378-1, SUSE-SU-2026:22451-1, SUSE-SU-2025:20805-1
SLE Micro 6.0 podman 4.9.5-7.1 SUSE-SU-2026:22516-1, SUSE-SU-2025:20869-1, SUSE-SU-2025:20692-1
SLE Micro 5.5 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1
SLE Micro 5.4 podman 4.9.5-150400.4.50.1 SUSE-SU-2025:02807-1
SLE Micro 5.3 podman 4.9.5-150400.4.50.1 SUSE-SU-2025:02807-1
SLE Micro 5.2 podman 4.9.5-150300.9.52.1 SUSE-SU-2025:02806-1
SLE Micro 5.1 podman 4.9.5-150300.9.52.1 SUSE-SU-2025:02806-1
SLE HPC 15 SP5 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1
SLE HPC 15 SP4 podman 4.9.5-150400.4.50.1 SUSE-SU-2025:02807-1
SLE HPC 15 SP3 podman 4.9.5-150300.9.52.1 SUSE-SU-2025:02806-1
SUSE Enterprise Storage 7.1 podman 4.9.5-150300.9.52.1 SUSE-SU-2025:02806-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250730T213748-1.1 openSUSE-SU-2025:15405-1
openSUSE Tumbleweed podman 5.5.2-1.1 openSUSE-SU-2025:15262-1
openSUSE Leap 16.0 podman 5.4.2-160000.4.1 openSUSE-SU-2026:21244-1, openSUSE-SU-2026:20305-1
openSUSE Leap 15.6 podman 4.9.5-150500.3.46.1 SUSE-SU-2025:02808-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 podman No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 podman +3 6:5.4.0-12.0.1.el10_0 ELSA-2025-10549
Oracle Linux 9 podman +4 5:5.4.0-12.0.1.el9_6 ELSA-2025-10550
Oracle Linux 8 aardvark-dns 2:1.10.1-2.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 buildah +1 2:1.33.12-2.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 cockpit-podman 84.1-1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 conmon 3:2.1.10-1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 container-selinux 2:2.229.0-2.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 containernetworking-plugins 1:1.4.0-6.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 containers-common 2:1-82.0.1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 crit +4 3.18-5.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 crun 1.14.3-2.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 fuse-overlayfs 1.13-1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 libslirp +1 4.4.0-2.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 netavark 2:1.10.3-1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 oci-seccomp-bpf-hook 1.2.10-1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 podman +6 4:4.9.4-22.0.1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 python3-podman 4.9.0-3.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 runc 1:1.1.12-6.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 skopeo +1 2:1.14.5-4.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 slirp4netns 1.2.3-1.module+el8.10.0+90626+f483dbeb ELSA-2025-10551
Oracle Linux 8 udica 0.2.6-21.module+el8.10.0+90626+f483dbeb ELSA-2025-10551

Affected packages

Advisories 34

References