Log in Start free

Vulnerability · Published Dec 12, 2024 · Assigned by redhat

CVE-2024-12401Cert-manager: potential dos when parsing specially crafted pem inputs

Medium 4.4

In plain English

A medium-severity improper input validation in cert-manager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cert-manager/cert-manager1.12.14GHSA-ghw8-3xqw-hhcj
Gogithub.com/cert-manager/cert-manager1.15.4GHSA-ghw8-3xqw-hhcj
Gogithub.com/cert-manager/cert-manager1.16.2GHSA-ghw8-3xqw-hhcj
Gogithub.com/cert-manager/cert-manager1.12.14GHSA-r4pg-vg54-wxx4
Gogithub.com/cert-manager/cert-manager1.15.4GHSA-r4pg-vg54-wxx4
Gogithub.com/cert-manager/cert-manager1.16.2GHSA-r4pg-vg54-wxx4
Gogithub.com/cert-manager/cert-manager1.12.14, 1.15.4, 1.16.2GO-2024-3282

Affected products (as reported)

VendorProductVersions
cert-manager 0 – through 1.12.141.13.0-alpha.0 – through 1.15.41.16.0-alpha.0 – through 1.16.2
Red Hat cert-manager Operator for Red Hat OpenShift see references
Red Hat cert-manager Operator for Red Hat OpenShift see references
Red Hat cert-manager Operator for Red Hat OpenShift see references
Red Hat cert-manager Operator for Red Hat OpenShift see references
Red Hat Cryostat 3 see references
Red Hat Multicluster Engine for Kubernetes see references
Red Hat Multicluster Engine for Kubernetes see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat OpenShift Serverless see references
Red Hat Red Hat Connectivity Link 1 see references
Red Hat Red Hat Connectivity Link 1 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat Openshift Data Foundation 4 see references
Red Hat Red Hat OpenShift GitOps see references

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

References