CVE-2024-12401

MEDIUM

cert-manager < 1.12.14 - Denial of Service via PEM Data Processing

Title source: llm
STIX 2.1

Description

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

References (8)

Core 8

Scores

CVSS v3 4.4
EPSS 0.0005
EPSS Percentile 16.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (9)
cert-manager/cert-manager 0 - 1.12.14Go
Red Hat/cert-manager Operator for Red Hat OpenShift
Red Hat/Cryostat 3
Red Hat/Multicluster Engine for Kubernetes
Red Hat/OpenShift Serverless
Red Hat/Red Hat Connectivity Link 1
Red Hat/Red Hat OpenShift Container Platform 4
Red Hat/Red Hat Openshift Data Foundation 4
Red Hat/Red Hat OpenShift GitOps
Published Dec 12, 2024
Tracked Since Feb 18, 2026