CVE-2024-12401: Cert-manager: potential dos when parsing specially crafted pem inputs
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references.
Original Description
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
Other sources
cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12401?
CVE-2024-12401 has been assessed as a moderate severity vulnerability.
How do I fix CVE-2024-12401?
To fix CVE-2024-12401, upgrade the cert-manager package to version 1.16.2, 1.15.4, or 1.12.14 depending on your existing version.
What software is affected by CVE-2024-12401?
CVE-2024-12401 affects cert-manager versions between 1.16.0-alpha.0 and 1.16.2, 1.13.0-alpha.0 and 1.15.4, and versions up to but not including 1.12.14.
What type of attack does CVE-2024-12401 allow?
CVE-2024-12401 allows an attacker to modify PEM data, potentially leading to unauthorized access.
Is CVE-2024-12401 a duplicate advisory?
Yes, CVE-2024-12401 has been withdrawn as it is a duplicate of GHSA-r4pg-vg54-wxx4.