Podman Improper Certificate Validation; machine missing TLS verification

Impact

The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.

Patches

https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3
Fixed in v5.5.2

Workarounds

Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)