CVE-2024-12401

Name of the Vulnerable Software and Affected Versions cert-manager versions 0.1.0 through 1.16.1 cert-manager versions 1.15.0 through 1.15.3 cert-manager versions 1.12.0 through 1.12.13

Description A flaw exists in the cert-manager package where the pem.Decode() function can take an excessive amount of time to process specially crafted invalid PEM data. An attacker capable of modifying PEM data read by cert-manager, such as data within a Secret resource, can cause high CPU utilization in the cert-manager controller pod. This creates a denial-of-service (DoS) condition for the cert-manager instance within the cluster.

Recommendations Update to version 1.16.2. Update to version 1.15.4. Update to version 1.12.14. Ensure that RBAC is scoped correctly in the cluster to restrict users from modifying resources containing PEM data.