Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs
# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references. # Original Description A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-12401US | — | — | ||
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amou… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2024-12401WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2327929WEB
- https://github.com/cert-manager/cert-managerPACKAGE
- https://github.com/cert-manager/cert-manager/pull/7400WEB
- https://github.com/cert-manager/cert-manager/pull/7401WEB
- https://github.com/cert-manager/cert-manager/pull/7402WEB
- https://github.com/cert-manager/cert-manager/pull/7403WEB
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan