PT-2024-17578 · Unknown · Cert-Manager

Naveensrinivasan · Published 2024-11-20 · Updated 2026-01-30 · CVE-2024-12401

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions cert-manager versions prior to 1.12.14 cert-manager versions prior to 1.15.4 cert-manager versions prior to 1.16.2

Description A flaw was found in the cert-manager package, allowing an attacker who can modify PEM data that the cert-manager reads to use large amounts of CPU in the cert-manager controller pod, effectively creating a denial-of-service (DoS) vector for the cert-manager in the cluster. This issue affects all versions of cert-manager since at least v0.1.0. The impact is reduced due to the limited size of Secrets in Kubernetes, but an attacker could still create a DoS vector by inserting many large-sized resources in the cluster.

Recommendations For versions prior to 1.12.14, update to version 1.12.14 or later. For versions prior to 1.15.4, update to version 1.15.4 or later. For versions prior to 1.16.2, update to version 1.16.2 or later. As a temporary workaround, ensure that RBAC is scoped correctly in your cluster to limit the ability of users to modify resources containing PEM data.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

AZL-54313

AZL-54324

CLEANSTART-2026-HV28992

CVE-2024-12401

GHSA-GHW8-3XQW-HHCJ

GHSA-R4PG-VG54-WXX4

GO-2024-3282

OPENSUSE-SU-2024:14599-1

Affected Products

Cert-Manager

References · 70

• https://nvd.nist.gov/vuln/detail/CVE-2022-30636 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-32149 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28948 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12401 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4pg-vg54-wxx4 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-54324 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29526 · Security Note
• https://osv.dev/vulnerability/GHSA-ghw8-3xqw-hhcj · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-HV28992 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-54313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12401 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24786 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1996 · Security Note