Podman Improper Certificate Validation; machine missing TLS verification

Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry which it does by default since 5.0.0 allowing a possible Man In The Middle attack. Patches...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the machine init process. An attacker can intercept or manipulate data in transit by performing a man-in-the-middle attack during the download of VM images from an OCI registry. Workaround This...

GHSA-65GG-3W2W-HR4H Podman Improper Certificate Validation; machine missing TLS verification

Impact The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry which it does by default since 5.0.0 allowing a possible Man In The Middle attack. Patches...

CVE-2025-41256

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates e.g., self-signed, since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5...

CVE-2025-41255

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates e.g., self-signed, unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17....

CVE-2025-41255 Cyberduck and Mountain Duck - Improper Certificate Store Handling

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates e.g., self-signed, unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17....

CVE-2025-41255 Cyberduck and Mountain Duck - Improper Certificate Store Handling

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates e.g., self-signed, unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17....

CVE-2025-41255

The CVE-2025-41255 issue affects Cyberduck and Mountain Duck through TLS certificate pinning handling. According to multiple sources, the vulnerable behavior is the unnecessary installation of untrusted certificates (e.g., self-signed) into the Windows Certificate Store of the current user, drive...

CVE-2025-41255 Cyberduck and Mountain Duck - Improper Certificate Store Handling

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates e.g., self-signed, unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17....

CVE-2025-41256 Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates e.g., self-signed, since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5...

CVE-2025-41256 Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates e.g., self-signed, since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5...

CVE-2025-41256 Cyberduck and Mountain Duck - Weak Hash Algorithm for Certificate Fingerprint

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates e.g., self-signed, since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5...

Security Bulletin: IBM Truststore Manager uses cryptography-44.0.0-cp39-abi3-manylinux_2_28_x86_64.whl which is vulnerable to CVE-2024-12797.

Summary IBM Truststore Manager uses cryptography-44.0.0-cp39-abi3-manylinux228x8664.whl which is vulnerable to CVE-2024-12797. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-12797 DESCRIPTION: Issue summary: Clients using RFC72...

PT-2025-26819 · Unknown +1 · Mountain Duck +1

Name of the Vulnerable Software and Affected Versions: Cyberduck versions prior to 9.1.7 Mountain Duck versions prior to 4.17.6 Description: The issue concerns improper handling of TLS certificate pinning for untrusted certificates, such as self-signed ones. This results in the unnecessary...

PT-2025-26818 · Unknown +1 · Mountain Duck +1

Name of the Vulnerable Software and Affected Versions: Cyberduck versions through 9.1.6 Mountain Duck versions through 4.17.5 Description: The issue is related to improper handling of TLS certificate pinning for untrusted certificates, such as self-signed certificates, in Cyberduck and Mountain...

Fedora 42 : glibc (2025-851644b160)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-851644b160 advisory. This update addresses two string function vulnerabilities specific to POWER10 machines CVE-2025-5702, CVE-2025-5745 and fixes a bug in TLS managemen...

Fedora 41 : glibc (2025-e489437b3d)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e489437b3d advisory. This update contains the following bug fixes and enhancements: String function register clobbers specific to POWER10 machines CVE-2025-5702,...

CVE-2025-6032

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...

AZL-64454 CVE-2025-6032 affecting package podman 5.6.1-10

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack...

CVE-2025-6032

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack. Mitigation Download the VM image manually with another tool that verifies the TLS certificate and...