CVE-2024-12401 Cert-manager: potential dos when parsing specially crafted pem inputs

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

CVE-2024-12401 Cert-manager: potential dos when parsing specially crafted pem inputs

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

CVE-2024-12401 Cert-manager: potential dos when parsing specially crafted pem inputs

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

CVE-2024-12401

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

AZL-54317 CVE-2024-45337 affecting package cert-manager for versions less than 1.11.2-16

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

AZL-54372 CVE-2024-45337 affecting package cert-manager for versions less than 1.12.13-2

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

GO-2024-3282 Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager

Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager...

GHSA-R4PG-VG54-WXX4 cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

GHSA-R4PG-VG54-WXX4 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, step-issuer, cert-manager-cmctl, cert-manager-webhook-pdns, cert-exporter, cert-manager-istio-csr...

PT-2024-17578

Name of the Vulnerable Software and Affected Versions cert-manager versions 0.1.0 through 1.16.1 cert-manager versions 1.15.0 through 1.15.3 cert-manager versions 1.12.0 through 1.12.13 Description A flaw exists in the cert-manager package where the pem.Decode function can take an excessive amoun...

AZL-52257 CVE-2024-51744 affecting package cert-manager for versions less than 1.11.2-22

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

AZL-52183 CVE-2024-51744 affecting package cert-manager for versions less than 1.12.15-1

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

CVE-2024-26147 affecting package cert-manager for versions less than 1.12.13-1

CVE-2024-26147 affecting package cert-manager for versions less than 1.12.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-6104 affecting package cert-manager for versions less than 1.12.12-3

CVE-2024-6104 affecting package cert-manager for versions less than 1.12.12-3. An upgraded version of the package is available that resolves this issue...

CVE-2024-24786 affecting package cert-manager for versions less than 1.11.2-14

CVE-2024-24786 affecting package cert-manager for versions less than 1.11.2-14. A patched version of the package is available...

CVE-2023-2253 affecting package cert-manager for versions less than 1.11.2-14

CVE-2023-2253 affecting package cert-manager for versions less than 1.11.2-14. A patched version of the package is available...

CVE-2024-28180 affecting package cert-manager for versions less than 1.11.2-14

CVE-2024-28180 affecting package cert-manager for versions less than 1.11.2-14. A patched version of the package is available...

CVE-2023-3978 affecting package cert-manager for versions less than 1.11.2-14

CVE-2023-3978 affecting package cert-manager for versions less than 1.11.2-14. A patched version of the package is available...

CVE-2023-45288 affecting package cert-manager for versions less than 1.12.12-1

CVE-2023-45288 affecting package cert-manager for versions less than 1.12.12-1. An upgraded version of the package is available that resolves this issue...