The containers/image library used by container tools; Podman, Builah, and Skopeo in Red Hat Enterprise Linux 8, and CRI-O in OpenShift Container Platform does not enforce TLS connections to the container registry authorization service [1]. An attacker could use this vulnerability launch a MiTM attack, and steal login credentials, or bearer tokens.

Upstream issue:

https://github.com/containers/image/issues/654

Upstream patch:

https://github.com/containers/image/pull/669

[1] https://docs.docker.com/registry/spec/auth/token/