Medium severity · published Dec 12, 2024
CVE-2024-12401
Cert-manager: potential dos when parsing specially crafted pem inputs
4.4
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
Cryostat 3 · Red Hat
All versions, or not specified · source: vendor
ME
Multicluster Engine for Kubernetes · Red Hat
All versions, or not specified · source: vendor
OS
OpenShift Serverless · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Connectivity Link 1 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift GitOps · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Openshift Data Foundation 4 · Red Hat
All versions, or not specified · source: vendor
CO
cert-manager Operator for Red Hat OpenShift · Red Hat
All versions, or not specified · source: vendor
Affected product
CO
cert-manager Operator for Red Hat OpenShift
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12401
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12401
access.redhat.com
https://access.redhat.com/security/cve/CVE-2024-12401
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2327929
github.com
https://github.com/cert-manager/cert-manager/pull/7400
github.com
https://github.com/cert-manager/cert-manager/pull/7401
github.com
https://github.com/cert-manager/cert-manager/pull/7402
github.com
https://github.com/cert-manager/cert-manager/pull/7403
More from cert-manager Operator for Red Hat OpenShift
9.1
CVE-2026-42508
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
9.1
CVE-2026-39832
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
8.2
CVE-2026-33810
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
7.5
CVE-2026-39829
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
7.5
CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net