Nixpkgs security tracker
Untriaged
Permalink
CVE-2025-6032
8.3 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
Podman: podman missing tls verification
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
References
Affected products
rhcos
- *
podman
- *
- <5.5.2
container-tools:rhel8
- *
container-tools:rhel8/podman
Matching in nixpkgs
pkgs.podman
Program for managing pods, containers and container images
pkgs.podman-tui
Podman Terminal UI
pkgs.podman-bootc
Streamlining podman+bootc interactions
pkgs.podman-compose
Implementation of docker-compose with podman backend
pkgs.podman-desktop
A graphical tool for developing on containers and Kubernetes
pkgs.nomad-driver-podman
Podman task driver for Nomad
pkgs.python311Packages.podman
Python bindings for Podman's RESTful API
pkgs.python312Packages.podman
Python bindings for Podman's RESTful API
pkgs.python313Packages.podman
Python bindings for Podman's RESTful API
Package maintainers
-
@cpcloud Phillip Cloud
-
@vdemeester Vincent Demeester <vincent@sbr.pm>
-
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@panda2134 panda2134 <me+nixpkgs@panda2134.site>
-
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-
@aaronjheng Aaron Jheng <wentworth@outlook.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@evan-goode Evan Goode <mail@evangoo.de>