Riskcovery

CVE-2024-12401

Cert-manager: potential dos when parsing specially crafted pem inputs

State
Published
Severity
4.4 Medium
Published
Dec 12, 2024
Updated
Jun 26, 2026
Reserved
Dec 10, 2024

Read the record on cve.org

Description

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

Scores

CVSSScoreVectorSource
3.14.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
cert-manager
  • 1.12.14 and earlierAffected
  • 1.13.0-alpha.0 through 1.15.4Affected
  • 1.16.0-alpha.0 through 1.16.2Affected
cert-manager Operator for Red Hat OpenShiftRed Hat
    cert-manager Operator for Red Hat OpenShiftRed Hat
      cert-manager Operator for Red Hat OpenShiftRed Hat
        cert-manager Operator for Red Hat OpenShiftRed Hat
          Cryostat 3Red Hat
            Multicluster Engine for KubernetesRed Hat
              Multicluster Engine for KubernetesRed Hat
                OpenShift ServerlessRed Hat
                  OpenShift ServerlessRed Hat
                    OpenShift ServerlessRed Hat
                      OpenShift ServerlessRed Hat
                        OpenShift ServerlessRed Hat
                          OpenShift ServerlessRed Hat
                            OpenShift ServerlessRed Hat
                              Red Hat Connectivity Link 1Red Hat
                                Red Hat Connectivity Link 1Red Hat
                                  Red Hat OpenShift Container Platform 4Red Hat
                                    Red Hat OpenShift Container Platform 4Red Hat
                                      Red Hat Openshift Data Foundation 4Red Hat
                                        Red Hat OpenShift GitOpsRed Hat

                                          References

                                          Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.