Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs
# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references. # Original Description A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-12401US | — | — | ||
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amou… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/CVE-2024-12401WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2327929WEB
- https://github.com/cert-manager/cert-managerPACKAGE
- https://github.com/cert-manager/cert-manager/pull/7400WEB
- https://github.com/cert-manager/cert-manager/pull/7401WEB
- https://github.com/cert-manager/cert-manager/pull/7402WEB
- https://github.com/cert-manager/cert-manager/pull/7403WEB
- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan