Listen to this Post
How the CVE Works:
Podman’s `machine init` command retrieves VM images from OCI registries without proper TLS certificate validation (default since v5.0.0). This flaw enables Man-in-the-Middle (MITM) attackers to intercept and replace downloaded images with malicious ones. The absence of certificate checks allows attackers to exploit weak or spoofed TLS handshakes, compromising VM integrity during initialization.
DailyCVE Form:
Platform: Podman
Version: <5.5.2
Vulnerability: TLS bypass
Severity: Critical
Date: 2025-06-25
Prediction: Patch by 2025-07-02
What Undercode Say:
podman machine init --image ./safe_image.qcow2 Manual workaround curl -O https://registry.example.com/image.qcow2 --cert-verify true Secure download
How Exploit:
1. Intercept Podman’s OCI registry connection.
2. Serve tampered VM image via MITM.
- Trigger `podman machine init` to execute malicious payloads.
Protection from this CVE:
- Upgrade to Podman v5.5.2+.
- Use `–image-path` with locally verified images.
- Enforce TLS verification via registry configuration.
Impact:
- Arbitrary code execution on host/VM.
- Supply chain compromise via poisoned images.
- Unauthorized access to containerized environments.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
