CVE-2024-12401
Fixed in a distro release EPSS <1%CVSS 4.4
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
Products: cert-manager Operator for Red Hat OpenShift, Red Hat Cryostat 3, Red Hat Multicluster Engine for Kubernetes, Red Hat OpenShift Serverless, Red Hat Connectivity Link 1, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift GitOps
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cert-manager/cert-manager | 1.12.14 |
| Go | github.com/cert-manager/cert-manager | 1.15.4 |
| Go | github.com/cert-manager/cert-manager | 1.16.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | aws-privateca-issuer | 1.4.0-r1 |
| Chainguard | aws-privateca-issuer-compat | 1.4.0-r1 |
| Chainguard | aws-privateca-issuer-compat-fips | 1.4.0-r1 |
| Chainguard | aws-privateca-issuer-fips | 1.4.0-r1 |
| Chainguard | cert-exporter | 2.13.0-r2 |
| Chainguard | cert-exporter-fips | 2.13.0-r2 |
| Chainguard | cert-manager-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-1.12-acmesolver | 1.12.14-r2 |
| Chainguard | cert-manager-1.12-cainjector | 1.12.14-r2 |
| Chainguard | cert-manager-1.12-controller | 1.12.14-r2 |
| Chainguard | cert-manager-1.12-webhook | 1.12.14-r2 |
| Chainguard | cert-manager-acmesolver-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-acmesolver-1.12-bitnami-compat | 1.12.14-r2 |
| Chainguard | cert-manager-acmesolver-1.12-iamguarded-compat | 1.12.14-r2 |
| Chainguard | cert-manager-acmesolver-fips-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-cainjector-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-cainjector-1.12-bitnami-compat | 1.12.14-r2 |
| Chainguard | cert-manager-cainjector-1.12-iamguarded-compat | 1.12.14-r2 |
| Chainguard | cert-manager-cainjector-fips-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-cmctl | 2.1.1-r1 |
| Chainguard | cert-manager-cmctl-fips | 2.1.1-r1 |
| Chainguard | cert-manager-controller-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-controller-1.12-bitnami-compat | 1.12.14-r2 |
| Chainguard | cert-manager-controller-1.12-iamguarded-compat | 1.12.14-r2 |
| Chainguard | cert-manager-controller-fips-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-fips-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-fips-1.12-acmesolver | 1.12.14-r2 |
| Chainguard | cert-manager-fips-1.12-cainjector | 1.12.14-r2 |
| Chainguard | cert-manager-fips-1.12-cmctl | 1.12.14-r2 |
| Chainguard | cert-manager-fips-1.12-controller | 1.12.14-r2 |
| Chainguard | cert-manager-fips-1.12-webhook | 1.12.14-r2 |
| Chainguard | cert-manager-istio-csr | 0.12.0-r1 |
| Chainguard | cert-manager-istio-csr-compat | 0.12.0-r1 |
| Chainguard | cert-manager-webhook-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-webhook-1.12-bitnami-compat | 1.12.14-r2 |
| Chainguard | cert-manager-webhook-1.12-iamguarded-compat | 1.12.14-r2 |
| Chainguard | cert-manager-webhook-fips-1.12 | 1.12.14-r2 |
| Chainguard | cert-manager-webhook-pdns | 2.5.1-r7 |
| Chainguard | cert-manager-webhook-pdns-fips | 2.5.1-r9 |
| Chainguard | cmctl-1.12 | 1.12.14-r2 |
| Chainguard | cmctl-1.12-fips | 1.12.14-r2 |
| Chainguard | cmctl-fips-1.12 | 1.12.14-r2 |
| Chainguard | step-issuer | 0.9.6-r0 |
| Chainguard | step-issuer-compat | 0.9.6-r0 |
| Chainguard | step-issuer-fips | 0.9.6-r0 |
| Chainguard | step-issuer-fips-compat | 0.9.6-r0 |
| Wolfi | aws-privateca-issuer | 1.4.0-r1 |
| Wolfi | aws-privateca-issuer-compat | 1.4.0-r1 |
| Wolfi | cert-exporter | 2.13.0-r2 |
| Wolfi | cert-manager-1.12 | 1.12.14-r2 |
| Wolfi | cert-manager-1.12-acmesolver | 1.12.14-r2 |
| Wolfi | cert-manager-1.12-cainjector | 1.12.14-r2 |
| Wolfi | cert-manager-1.12-controller | 1.12.14-r2 |
| Wolfi | cert-manager-1.12-webhook | 1.12.14-r2 |
| Wolfi | cert-manager-cmctl | 2.1.1-r1 |
| Wolfi | cert-manager-istio-csr | 0.12.0-r1 |
| Wolfi | cert-manager-istio-csr-compat | 0.12.0-r1 |
| Wolfi | cert-manager-webhook-pdns | 2.5.1-r7 |
| Wolfi | cmctl-1.12 | 1.12.14-r2 |
| Wolfi | step-issuer | 0.9.6-r0 |
| Wolfi | step-issuer-compat | 0.9.6-r0 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241213T205935-1.1 |