CVE-2024-12401

Published: Dec 12, 2024Modified: Jun 26, 2026Deferred

4.4

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 0.7 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

https://access.redhat.com/security/cve/CVE-2024-12401

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2327929

Source: secalert@redhat.com

https://github.com/cert-manager/cert-manager/pull/7400

Source: secalert@redhat.com

https://github.com/cert-manager/cert-manager/pull/7401

Source: secalert@redhat.com

https://github.com/cert-manager/cert-manager/pull/7402

Source: secalert@redhat.com

https://github.com/cert-manager/cert-manager/pull/7403

Source: secalert@redhat.com

https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4

Source: secalert@redhat.com

https://go.dev/issue/50116

Source: secalert@redhat.com

Timeline

No history available yet.