Description
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cert-manager | ≤ 1.12.14, 1.13.0-alpha.0 – ≤ 1.15.4, 1.16.0-alpha.0 – ≤ 1.16.2 | — |
| Red Hat | cert-manager Operator for Red Hat OpenShift | — | — |
| Red Hat | Cryostat 3 | — | — |
| Red Hat | Multicluster Engine for Kubernetes | — | — |
| Red Hat | OpenShift Serverless | — | — |
| Red Hat | Red Hat Connectivity Link 1 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat Openshift Data Foundation 4 | — | — |
| Red Hat | Red Hat OpenShift GitOps | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241213T205935-1.1 | openSUSE-SU-2024:14599-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cert-manager | 1.12.15-1 | — |
| Azure Linux 2 (CBL-Mariner) | cert-manager | 1.11.2-18 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aws-privateca-issuer +1 | 1.4.0-r1 | — |
| Wolfi rolling | cert-exporter | 2.13.0-r2 | — |
| Wolfi rolling | cert-manager-cmctl | 2.1.1-r1 | — |
| Wolfi rolling | cert-manager-istio-csr +1 | 0.12.0-r1 | — |
| Wolfi rolling | cert-manager-webhook-pdns | 2.5.1-r7 | — |
| Wolfi rolling | step-issuer | 0.9.6-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cert-manager/cert-manager | < 1.12.14 | 1.12.14 | GHSA-r4pg-vg54-wxx4 |
| Go | github.com/cert-manager/cert-manager | >= 1.13.0-alpha.0, < 1.15.4 | 1.15.4 | GHSA-r4pg-vg54-wxx4 |
| Go | github.com/cert-manager/cert-manager | >= 1.16.0-alpha.0, < 1.16.2 | 1.16.2 | GHSA-r4pg-vg54-wxx4 |
| Go | github.com/cert-manager/cert-manager | < 1.12.14 · >= 1.13.0-alpha.0, < 1.15.4 · >= 1.16.0-alpha.0, < 1.16.2 | 1.12.14, 1.15.4, 1.16.2 | GO-2024-3282 |
Advisories 1
- openSUSE-SU-2024:14599-1 govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://access.redhat.com/security/cve/CVE-2024-12401 vdb-entry
- RHBZ#2327929 issue-tracking
- https://github.com/cert-manager/cert-manager/pull/7400
- https://github.com/cert-manager/cert-manager/pull/7401
- https://github.com/cert-manager/cert-manager/pull/7402
- https://github.com/cert-manager/cert-manager/pull/7403
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
- https://go.dev/issue/50116