ALT-BU-2025-9684-2

Branch sisyphus update bulletin.

Package podman updated to version 5.5.2-alt1 for branch sisyphus in task 390805.

Уязвимость программного средства управления и запуска OCI-контейнеров Podman, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю выполнить атаку типа «человек посередине»

Severity: HIGH (8.3)Vector: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Severity: HIGH (7.6)Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

References:

CVE-2025-6032

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Severity: HIGH (8.3)Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References:

Podman Improper Certificate Validation; machine missing TLS verification

Severity: HIGH (8.3)Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References:

Version: 2.1.2

Branch sisyphus update on 2025-07-27

ALT-BU-2025-9684-2

ALT-PU-2025-9676-2

Closed vulnerabilities

BDU:2025-09074

CVE-2025-6032

GHSA-65gg-3w2w-hr4h