CVE-2025-64432 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-64432 Interim 1 2 2026-03-05T00:27:02Z current 2025-12-23T00:15:40Z 2026-03-05T00:27:02Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-64432 KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2025-December/023449.html E-Mail link for SUSE-SU-2025:4330-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.23 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd SLES-LTSS-TERADATA 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 openSUSE Leap 15.6 openSUSE Leap 16.0 containerized-data-importer containerized-data-importer-api containerized-data-importer-cloner containerized-data-importer-controller containerized-data-importer-importer containerized-data-importer-manifests containerized-data-importer-operator containerized-data-importer-uploadproxy containerized-data-importer-uploadserver kubevirt-container-disk-1.7.0-160000.1.1 kubevirt-manifests-1.6.3-150700.3.13.1 kubevirt-manifests-1.7.0-160000.1.1 kubevirt-pr-helper-conf-1.7.0-160000.1.1 kubevirt-sidecar-shim-1.7.0-160000.1.1 kubevirt-tests-1.7.0-160000.1.1 kubevirt-virt-api-1.7.0-160000.1.1 kubevirt-virt-controller-1.7.0-160000.1.1 kubevirt-virt-exportproxy-1.7.0-160000.1.1 kubevirt-virt-exportserver-1.7.0-160000.1.1 kubevirt-virt-handler-1.7.0-160000.1.1 kubevirt-virt-launcher-1.7.0-160000.1.1 kubevirt-virt-operator-1.7.0-160000.1.1 kubevirt-virt-synchronization-controller-1.7.0-160000.1.1 kubevirt-virtctl-1.6.3-150700.3.13.1 kubevirt-virtctl-1.7.0-160000.1.1 obs-service-cdi_containers_meta obs-service-kubevirt_containers_meta-1.7.0-160000.1.1 podman-5.4.2-slfo.1.1_2.1 podman-5.4.2-slfo.1.1_2.1 as a component of Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.23 podman-5.4.2-slfo.1.1_2.1 as a component of Image SL-Micro-Azure podman-5.4.2-slfo.1.1_2.1 as a component of Image SL-Micro-BYOS-Azure podman-5.4.2-slfo.1.1_2.1 as a component of Image SL-Micro-BYOS-EC2 podman-5.4.2-slfo.1.1_2.1 as a component of Image SL-Micro-BYOS-GCE podman-5.4.2-slfo.1.1_2.1 as a component of Image SL-Micro-EC2 podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-Azure-llc podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-Azure-ltd podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-EC2-llc podman-5.4.2-slfo.1.1_2.1 as a component of Image SUSE-Multi-Linux-Manager-Server-EC2-ltd kubevirt-manifests-1.6.3-150700.3.13.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt-virtctl-1.6.3-150700.3.13.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP7 kubevirt-container-disk-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-manifests-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-pr-helper-conf-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-sidecar-shim-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-tests-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-api-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-controller-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-exportproxy-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-exportserver-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-handler-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-launcher-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-operator-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virt-synchronization-controller-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virtctl-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 obs-service-kubevirt_containers_meta-1.7.0-160000.1.1 as a component of openSUSE Leap 16.0 kubevirt-virtctl-1.7.0-160000.1.1 as a component of SUSE Linux Enterprise Server 16.0 containerized-data-importer as a component of SLES-LTSS-TERADATA 15 SP2 containerized-data-importer-manifests as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS containerized-data-importer as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS containerized-data-importer as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS containerized-data-importer as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS containerized-data-importer-manifests as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS containerized-data-importer as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise Micro 5.3 containerized-data-importer as a component of SUSE Linux Enterprise Micro 5.3 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Micro 5.4 containerized-data-importer as a component of SUSE Linux Enterprise Micro 5.4 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Micro 5.5 containerized-data-importer as a component of SUSE Linux Enterprise Micro 5.5 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Module for Containers 15 SP6 containerized-data-importer as a component of SUSE Linux Enterprise Module for Containers 15 SP6 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Module for Containers 15 SP7 containerized-data-importer as a component of SUSE Linux Enterprise Module for Containers 15 SP7 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server 15 SP2-LTSS containerized-data-importer as a component of SUSE Linux Enterprise Server 15 SP2-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server 15 SP3-LTSS containerized-data-importer as a component of SUSE Linux Enterprise Server 15 SP3-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server 15 SP4-LTSS containerized-data-importer as a component of SUSE Linux Enterprise Server 15 SP4-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server 15 SP5-LTSS containerized-data-importer as a component of SUSE Linux Enterprise Server 15 SP5-LTSS containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server 15 SP6-LTSS containerized-data-importer as a component of SUSE Linux Enterprise Server 15 SP6-LTSS containerized-data-importer as a component of SUSE Linux Enterprise Server Teradata 15 SP4 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 containerized-data-importer as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 containerized-data-importer as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 containerized-data-importer as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 containerized-data-importer-manifests as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 containerized-data-importer as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 containerized-data-importer-manifests as a component of SUSE Linux Micro 6.0 containerized-data-importer as a component of SUSE Linux Micro 6.0 containerized-data-importer-manifests as a component of SUSE Linux Micro 6.1 containerized-data-importer as a component of SUSE Linux Micro 6.1 containerized-data-importer-api as a component of openSUSE Leap 15.6 containerized-data-importer-cloner as a component of openSUSE Leap 15.6 containerized-data-importer-controller as a component of openSUSE Leap 15.6 containerized-data-importer-importer as a component of openSUSE Leap 15.6 containerized-data-importer-manifests as a component of openSUSE Leap 15.6 containerized-data-importer-operator as a component of openSUSE Leap 15.6 containerized-data-importer-uploadproxy as a component of openSUSE Leap 15.6 containerized-data-importer-uploadserver as a component of openSUSE Leap 15.6 obs-service-cdi_containers_meta as a component of openSUSE Leap 15.6 containerized-data-importer as a component of openSUSE Leap 15.6 KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1. CVE-2025-64432 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.23:podman-5.4.2-slfo.1.1_2.1 Image SL-Micro-Azure:podman-5.4.2-slfo.1.1_2.1 Image SL-Micro-BYOS-Azure:podman-5.4.2-slfo.1.1_2.1 Image SL-Micro-BYOS-EC2:podman-5.4.2-slfo.1.1_2.1 Image SL-Micro-BYOS-GCE:podman-5.4.2-slfo.1.1_2.1 Image SL-Micro-EC2:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-Azure-llc:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-EC2-llc:podman-5.4.2-slfo.1.1_2.1 Image SUSE-Multi-Linux-Manager-Server-EC2-ltd:podman-5.4.2-slfo.1.1_2.1 SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt-manifests-1.6.3-150700.3.13.1 SUSE Linux Enterprise Module for Containers 15 SP7:kubevirt-virtctl-1.6.3-150700.3.13.1 openSUSE Leap 16.0:kubevirt-container-disk-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-manifests-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-pr-helper-conf-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-sidecar-shim-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-tests-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-api-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-controller-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-exportproxy-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-exportserver-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-handler-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-launcher-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-operator-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virt-synchronization-controller-1.7.0-160000.1.1 openSUSE Leap 16.0:kubevirt-virtctl-1.7.0-160000.1.1 openSUSE Leap 16.0:obs-service-kubevirt_containers_meta-1.7.0-160000.1.1 SUSE Linux Enterprise Server 16.0:kubevirt-virtctl-1.7.0-160000.1.1 SLES-LTSS-TERADATA 15 SP2:containerized-data-importer SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:containerized-data-importer SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:containerized-data-importer SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:containerized-data-importer SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:containerized-data-importer-manifests SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:containerized-data-importer SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise Micro 5.3:containerized-data-importer SUSE Linux Enterprise Micro 5.3:containerized-data-importer-manifests SUSE Linux Enterprise Micro 5.4:containerized-data-importer SUSE Linux Enterprise Micro 5.4:containerized-data-importer-manifests SUSE Linux Enterprise Micro 5.5:containerized-data-importer SUSE Linux Enterprise Micro 5.5:containerized-data-importer-manifests SUSE Linux Enterprise Module for Containers 15 SP6:containerized-data-importer SUSE Linux Enterprise Module for Containers 15 SP6:containerized-data-importer-manifests SUSE Linux Enterprise Module for Containers 15 SP7:containerized-data-importer SUSE Linux Enterprise Module for Containers 15 SP7:containerized-data-importer-manifests SUSE Linux Enterprise Server 15 SP2-LTSS:containerized-data-importer SUSE Linux Enterprise Server 15 SP2-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise Server 15 SP3-LTSS:containerized-data-importer SUSE Linux Enterprise Server 15 SP3-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise Server 15 SP4-LTSS:containerized-data-importer SUSE Linux Enterprise Server 15 SP4-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise Server 15 SP5-LTSS:containerized-data-importer SUSE Linux Enterprise Server 15 SP5-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise Server 15 SP6-LTSS:containerized-data-importer SUSE Linux Enterprise Server 15 SP6-LTSS:containerized-data-importer-manifests SUSE Linux Enterprise Server Teradata 15 SP4:containerized-data-importer SUSE Linux Enterprise Server for SAP Applications 15 SP3:containerized-data-importer SUSE Linux Enterprise Server for SAP Applications 15 SP3:containerized-data-importer-manifests SUSE Linux Enterprise Server for SAP Applications 15 SP4:containerized-data-importer SUSE Linux Enterprise Server for SAP Applications 15 SP4:containerized-data-importer-manifests SUSE Linux Enterprise Server for SAP Applications 15 SP5:containerized-data-importer SUSE Linux Enterprise Server for SAP Applications 15 SP5:containerized-data-importer-manifests SUSE Linux Enterprise Server for SAP Applications 15 SP6:containerized-data-importer SUSE Linux Enterprise Server for SAP Applications 15 SP6:containerized-data-importer-manifests SUSE Linux Micro 6.0:containerized-data-importer SUSE Linux Micro 6.0:containerized-data-importer-manifests SUSE Linux Micro 6.1:containerized-data-importer SUSE Linux Micro 6.1:containerized-data-importer-manifests openSUSE Leap 15.6:containerized-data-importer openSUSE Leap 15.6:containerized-data-importer-api openSUSE Leap 15.6:containerized-data-importer-cloner openSUSE Leap 15.6:containerized-data-importer-controller openSUSE Leap 15.6:containerized-data-importer-importer openSUSE Leap 15.6:containerized-data-importer-manifests openSUSE Leap 15.6:containerized-data-importer-operator openSUSE Leap 15.6:containerized-data-importer-uploadproxy openSUSE Leap 15.6:containerized-data-importer-uploadserver openSUSE Leap 15.6:obs-service-cdi_containers_meta moderate 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H