Podman TLS Verification Flaw in Image Download Process Allows Man-In-The-Middle Attacks

A vulnerability exists in Podman versions 4.8.0 and later, including 5.0.0, where the 'podman machine init' command does not properly verify TLS certificates when downloading virtual machine images from an OCI registry. This oversight could allow a Man-In-The-Middle (MITM) attack, as an attacker could intercept the network traffic between the registry and the client. The vulnerability arises because, although TLS verification is enabled by default in Podman 5.0.0 and later, the issue was introduced in version 4.8.0 and affects Red Hat Enterprise Linux (RHEL) 8.10, RHEL 9.4, and OpenShift Container Platform (OCP) 4.16.

Impact

Exploitation of this vulnerability could lead to a Man-In-The-Middle attack, where an attacker intercepts and potentially alters the communication between the Podman client and the OCI registry.