| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/containers/podman | all versions | |
| github.com/containers/podman/v2 | all versions | |
| github.com/containers/podman/v3 | all versions | |
| github.com/containers/podman/v4 | ≥ 4.8.0, ≤ 4.9.5≥ 4.8.0 | |
| github.com/containers/podman/v5 | < 5.5.2 | 5.5.2 |
The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.
https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2
Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free