CVE-2024-12401 (GCVE-0-2024-12401)

Vulnerability from cvelistv5 – Published: 2024-12-12 09:06 – Updated: 2026-06-26 04:27

Title

Cert-manager: potential dos when parsing specially crafted pem inputs

Summary

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-12 15:21 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

8 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2024-12401	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2327929	issue-trackingx_refsource_REDHAT
https://github.com/cert-manager/cert-manager/pull/7400
https://github.com/cert-manager/cert-manager/pull/7401
https://github.com/cert-manager/cert-manager/pull/7402
https://github.com/cert-manager/cert-manager/pull/7403
https://github.com/cert-manager/cert-manager/secu…
https://go.dev/issue/50116

Impacted products

9 products

Vendor	Product	Version
		Affected: 0 , ≤ 1.12.14 (semver) Affected: 1.13.0-alpha.0 , ≤ 1.15.4 (semver) Affected: 1.16.0-alpha.0 , ≤ 1.16.2 (semver)
Red Hat	cert-manager Operator for Red Hat OpenShift	cpe:/a:redhat:cert_manager:1
Red Hat	Cryostat 3	cpe:/a:redhat:cryostat:3
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	Red Hat Connectivity Link 1	cpe:/a:redhat:connectivity_link:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1

Date Public

2024-11-21 19:52

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T15:21:20.829376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T15:44:58.794Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/cert-manager/cert-manager",
          "defaultStatus": "unaffected",
          "packageName": "cert-manager",
          "versions": [
            {
              "lessThanOrEqual": "1.12.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.15.4",
              "status": "affected",
              "version": "1.13.0-alpha.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.16.2",
              "status": "affected",
              "version": "1.16.0-alpha.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager/jetstack-cert-manager-rhel9",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager-operator-bundle-container",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager-operator-container",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cryostat:3"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat-tech-preview/cryostat-rhel8-operator",
          "product": "Cryostat 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/assisted-service-8-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/assisted-service-9-rhel9",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-activator-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-autoscaler-hpa-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-autoscaler-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-controller-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-queue-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-storage-version-migration-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-webhook-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:connectivity_link:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcl-operator-bundle-container",
          "product": "Red Hat Connectivity Link 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:connectivity_link:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcl-operator-container",
          "product": "Red Hat Connectivity Link 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-api-server-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-contour-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_data_foundation:4"
          ],
          "defaultStatus": "affected",
          "packageName": "odf4/rook-ceph-rhel8-operator",
          "product": "Red Hat Openshift Data Foundation 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-11-21T19:52:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T04:27:26.590Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-12401"
        },
        {
          "name": "RHBZ#2327929",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327929"
        },
        {
          "url": "https://github.com/cert-manager/cert-manager/pull/7400"
        },
        {
          "url": "https://github.com/cert-manager/cert-manager/pull/7401"
        },
        {
          "url": "https://github.com/cert-manager/cert-manager/pull/7402"
        },
        {
          "url": "https://github.com/cert-manager/cert-manager/pull/7403"
        },
        {
          "url": "https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"
        },
        {
          "url": "https://go.dev/issue/50116"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-21T23:00:43.367Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-11-21T19:52:52.000Z",
          "value": "Made public."
        }
      ],
      "title": "Cert-manager: potential dos when parsing specially crafted pem inputs",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-20: Improper Input Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-12401",
    "datePublished": "2024-12-12T09:06:03.612Z",
    "dateReserved": "2024-12-10T13:30:10.806Z",
    "dateUpdated": "2026-06-26T04:27:26.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-12401",
      "date": "2026-11-07",
      "epss": "0.00673",
      "percentile": "0.52347"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com/cert-manager/cert-manager",
                "defaultStatus": "unaffected",
                "packageName": "cert-manager",
                "versions": [
                  {
                    "lessThanOrEqual": "1.12.14",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "1.15.4",
                    "status": "affected",
                    "version": "1.13.0-alpha.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "1.16.2",
                    "status": "affected",
                    "version": "1.16.0-alpha.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:cert_manager:1"
                ],
                "defaultStatus": "affected",
                "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9",
                "product": "cert-manager Operator for Red Hat OpenShift",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:cert_manager:1"
                ],
                "defaultStatus": "affected",
                "packageName": "cert-manager/jetstack-cert-manager-rhel9",
                "product": "cert-manager Operator for Red Hat OpenShift",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:cert_manager:1"
                ],
                "defaultStatus": "affected",
                "packageName": "cert-manager-operator-bundle-container",
                "product": "cert-manager Operator for Red Hat OpenShift",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:cert_manager:1"
                ],
                "defaultStatus": "affected",
                "packageName": "cert-manager-operator-container",
                "product": "cert-manager Operator for Red Hat OpenShift",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:cryostat:3"
                ],
                "defaultStatus": "affected",
                "packageName": "cryostat-tech-preview/cryostat-rhel8-operator",
                "product": "Cryostat 3",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:multicluster_engine"
                ],
                "defaultStatus": "affected",
                "packageName": "multicluster-engine/assisted-service-8-rhel8",
                "product": "Multicluster Engine for Kubernetes",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:multicluster_engine"
                ],
                "defaultStatus": "affected",
                "packageName": "multicluster-engine/assisted-service-9-rhel9",
                "product": "Multicluster Engine for Kubernetes",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-activator-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-autoscaler-hpa-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-autoscaler-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-controller-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-queue-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-storage-version-migration-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:serverless:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-serverless-1/serving-webhook-rhel8",
                "product": "OpenShift Serverless",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:connectivity_link:1"
                ],
                "defaultStatus": "affected",
                "packageName": "rhcl-operator-bundle-container",
                "product": "Red Hat Connectivity Link 1",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:connectivity_link:1"
                ],
                "defaultStatus": "affected",
                "packageName": "rhcl-operator-container",
                "product": "Red Hat Connectivity Link 1",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift:4"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift4/ose-agent-installer-api-server-rhel9",
                "product": "Red Hat OpenShift Container Platform 4",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift:4"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift4/ose-contour-rhel8",
                "product": "Red Hat OpenShift Container Platform 4",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_data_foundation:4"
                ],
                "defaultStatus": "affected",
                "packageName": "odf4/rook-ceph-rhel8-operator",
                "product": "Red Hat Openshift Data Foundation 4",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_gitops:1"
                ],
                "defaultStatus": "affected",
                "packageName": "openshift-gitops-1/gitops-rhel8-operator",
                "product": "Red Hat OpenShift GitOps",
                "vendor": "Red Hat"
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster."
          },
          {
            "lang": "es",
            "value": " Se encontr\u00f3 una falla en el paquete cert-manager. Esta falla permite que un atacante que pueda modificar los datos PEM que lee el cert-manager, por ejemplo, en un recurso secreto, utilice grandes cantidades de CPU en el m\u00f3dulo controlador del cert-manager para crear efectivamente un vector de denegaci\u00f3n de servicio (DoS) para el cert-manager en el cl\u00faster."
          }
        ],
        "id": "CVE-2024-12401",
        "lastModified": "2026-06-26T05:16:25.573",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.7,
              "impactScore": 3.6,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-12401",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T15:21:20.829376Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-12-12T09:15:05.790",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2024-12401"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327929"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/cert-manager/cert-manager/pull/7400"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/cert-manager/cert-manager/pull/7401"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/cert-manager/cert-manager/pull/7402"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/cert-manager/cert-manager/pull/7403"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://go.dev/issue/50116"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-26T04:27:25+00:00",
      "cve": "CVE-2024-12401",
      "id": "CVE-2024-12401",
      "initial_release_date": "2024-11-21T19:52:52+00:00",
      "product_status:known_affected": "20",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cert-manager: potential DoS when parsing specially crafted PEM inputs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12401.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-12401",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-12-12T15:21:20.829376Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-12-12T15:21:22.005Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/cert-manager/cert-manager",
              "defaultStatus": "unaffected",
              "packageName": "cert-manager",
              "versions": [
                {
                  "lessThanOrEqual": "1.12.14",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "1.15.4",
                  "status": "affected",
                  "version": "1.13.0-alpha.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "1.16.2",
                  "status": "affected",
                  "version": "1.16.0-alpha.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:cert_manager:1"
              ],
              "defaultStatus": "affected",
              "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9",
              "product": "cert-manager Operator for Red Hat OpenShift",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:cert_manager:1"
              ],
              "defaultStatus": "affected",
              "packageName": "cert-manager/jetstack-cert-manager-rhel9",
              "product": "cert-manager Operator for Red Hat OpenShift",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:cert_manager:1"
              ],
              "defaultStatus": "affected",
              "packageName": "cert-manager-operator-bundle-container",
              "product": "cert-manager Operator for Red Hat OpenShift",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:cert_manager:1"
              ],
              "defaultStatus": "affected",
              "packageName": "cert-manager-operator-container",
              "product": "cert-manager Operator for Red Hat OpenShift",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:cryostat:3"
              ],
              "defaultStatus": "affected",
              "packageName": "cryostat-tech-preview/cryostat-rhel8-operator",
              "product": "Cryostat 3",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:multicluster_engine"
              ],
              "defaultStatus": "affected",
              "packageName": "multicluster-engine/assisted-service-8-rhel8",
              "product": "Multicluster Engine for Kubernetes",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:multicluster_engine"
              ],
              "defaultStatus": "affected",
              "packageName": "multicluster-engine/assisted-service-9-rhel9",
              "product": "Multicluster Engine for Kubernetes",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-activator-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-autoscaler-hpa-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-autoscaler-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-controller-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-queue-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-storage-version-migration-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:serverless:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-serverless-1/serving-webhook-rhel8",
              "product": "OpenShift Serverless",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:connectivity_link:1"
              ],
              "defaultStatus": "affected",
              "packageName": "rhcl-operator-bundle-container",
              "product": "Red Hat Connectivity Link 1",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:connectivity_link:1"
              ],
              "defaultStatus": "affected",
              "packageName": "rhcl-operator-container",
              "product": "Red Hat Connectivity Link 1",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift4/ose-agent-installer-api-server-rhel9",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift4/ose-contour-rhel8",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_data_foundation:4"
              ],
              "defaultStatus": "affected",
              "packageName": "odf4/rook-ceph-rhel8-operator",
              "product": "Red Hat Openshift Data Foundation 4",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_gitops:1"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift-gitops-1/gitops-rhel8-operator",
              "product": "Red Hat OpenShift GitOps",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2024-11-21T19:52:52.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Low"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-26T04:27:26.590Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2024-12401"
            },
            {
              "name": "RHBZ#2327929",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327929"
            },
            {
              "url": "https://github.com/cert-manager/cert-manager/pull/7400"
            },
            {
              "url": "https://github.com/cert-manager/cert-manager/pull/7401"
            },
            {
              "url": "https://github.com/cert-manager/cert-manager/pull/7402"
            },
            {
              "url": "https://github.com/cert-manager/cert-manager/pull/7403"
            },
            {
              "url": "https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"
            },
            {
              "url": "https://go.dev/issue/50116"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2024-11-21T23:00:43.367Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2024-11-21T19:52:52.000Z",
              "value": "Made public."
            }
          ],
          "title": "Cert-manager: potential dos when parsing specially crafted pem inputs",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-20: Improper Input Validation"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2024-12401",
        "datePublished": "2024-12-12T09:06:03.612Z",
        "dateReserved": "2024-12-10T13:30:10.806Z",
        "dateUpdated": "2026-06-26T04:27:26.590Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2025-OY13195 (CVE-2024-12401)

Vulnerability from cleanstart – Published: 2026-09-18 10:31 – Updated: 2026-10-08 17:54 – Source website

Summary

Security fix for CVE-2024-12401 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0

Details

Security vulnerability affects the cert-manager-webhook-pdns-fips package. This issue is resolved in later releases. See references for vulnerability details.

Severity

4.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2024-12401	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2024-12401	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "cert-manager-webhook-pdns-fips",
        "purl": "pkg:apk/cleanstart/cert-manager-webhook-pdns-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the cert-manager-webhook-pdns-fips package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2025-OY13195",
  "modified": "2026-10-08T17:54:44Z",
  "published": "2026-09-18T10:31:06.392700Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2025/CLEANSTART-2025-OY13195.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-12401"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12401"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Security fix for CVE-2024-12401 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0",
  "upstream": [
    "CVE-2024-12401"
  ]
}

CLEANSTART-2026-EP15881 (CVE-2022-1996)

Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in cert-manager-webhook-pdns-fips 2.3.0-r0

Details

Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...

References

URL

Type

https://github.com/zachomedia/cert-manager-webhook-pdns

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "cert-manager-webhook-pdns-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.0-r0"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...",
  "id": "CLEANSTART-2026-EP15881",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zachomedia/cert-manager-webhook-pdns"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in cert-manager-webhook-pdns-fips 2.3.0-r0",
  "upstream": [
    "CVE-2022-1996",
    "CVE-2023-45142",
    "CVE-2023-25151",
    "CVE-2022-21698",
    "CVE-2022-30636",
    "CVE-2022-27191",
    "CVE-2023-48795",
    "CVE-2023-44487",
    "CVE-2023-47108",
    "CVE-2022-32149",
    "CVE-2022-28948",
    "CVE-2022-27664",
    "CVE-2024-12401",
    "CVE-2022-29526",
    "CVE-2024-24786",
    "ghsa-m425-mq94-257g",
    "ghsa-r4pg-vg54-wxx4"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-HV28992 (CVE-2022-1996)

Vulnerability from cleanstart – Published: 2026-01-30 15:55 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3

Details

Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3. See references for individual vulnerability details.

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2022-1996	WEB
	https://osv.dev/vulnerability/CVE-2022-27191	WEB
	https://osv.dev/vulnerability/CVE-2022-27664	WEB
	https://osv.dev/vulnerability/CVE-2022-28948	WEB
	https://osv.dev/vulnerability/CVE-2022-29526	WEB
	https://osv.dev/vulnerability/CVE-2022-30636	WEB
	https://osv.dev/vulnerability/CVE-2022-32149	WEB
	https://osv.dev/vulnerability/CVE-2023-44487	WEB
	https://osv.dev/vulnerability/CVE-2024-12401	WEB
	https://osv.dev/vulnerability/CVE-2024-24786	WEB
	https://osv.dev/vulnerability/GHSA-M425-MQ94-257G	WEB
	https://osv.dev/vulnerability/GHSA-R4PG-VG54-WXX4	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-1996	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-27191	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-27664	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-28948	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-29526	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-30636	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2022-32149	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2023-44487	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2024-12401	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2024-24786	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "cert-manager-webhook-pdns-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-HV28992",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-01-30T15:55:24.450018Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HV28992"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-1996"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-27191"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-27664"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-28948"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-29526"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-30636"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2022-32149"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-12401"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2024-24786"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/GHSA-M425-MQ94-257G"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/GHSA-R4PG-VG54-WXX4"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1996"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27191"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28948"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29526"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30636"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12401"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3",
  "upstream": [
    "CVE-2022-1996",
    "CVE-2022-27191",
    "CVE-2022-27664",
    "CVE-2022-28948",
    "CVE-2022-29526",
    "CVE-2022-30636",
    "CVE-2022-32149",
    "CVE-2023-44487",
    "CVE-2024-12401",
    "CVE-2024-24786",
    "GHSA-M425-MQ94-257G",
    "GHSA-R4PG-VG54-WXX4"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2024-12401

Vulnerability from fkie_nvd - Published: 2024-12-12 09:15 - Updated: 2026-06-26 05:16

Severity

4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2024-12401
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2327929
	secalert@redhat.com	https://github.com/cert-manager/cert-manager/pull/7400
	secalert@redhat.com	https://github.com/cert-manager/cert-manager/pull/7401
	secalert@redhat.com	https://github.com/cert-manager/cert-manager/pull/7402
	secalert@redhat.com	https://github.com/cert-manager/cert-manager/pull/7403
	secalert@redhat.com	https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
	secalert@redhat.com	https://go.dev/issue/50116

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/cert-manager/cert-manager",
          "defaultStatus": "unaffected",
          "packageName": "cert-manager",
          "versions": [
            {
              "lessThanOrEqual": "1.12.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.15.4",
              "status": "affected",
              "version": "1.13.0-alpha.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.16.2",
              "status": "affected",
              "version": "1.16.0-alpha.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager/jetstack-cert-manager-rhel9",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager-operator-bundle-container",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:cert_manager:1"
          ],
          "defaultStatus": "affected",
          "packageName": "cert-manager-operator-container",
          "product": "cert-manager Operator for Red Hat OpenShift",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:cryostat:3"
          ],
          "defaultStatus": "affected",
          "packageName": "cryostat-tech-preview/cryostat-rhel8-operator",
          "product": "Cryostat 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/assisted-service-8-rhel8",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_engine"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-engine/assisted-service-9-rhel9",
          "product": "Multicluster Engine for Kubernetes",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-activator-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-autoscaler-hpa-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-autoscaler-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-controller-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-queue-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-storage-version-migration-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-1/serving-webhook-rhel8",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:connectivity_link:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcl-operator-bundle-container",
          "product": "Red Hat Connectivity Link 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:connectivity_link:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcl-operator-container",
          "product": "Red Hat Connectivity Link 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-agent-installer-api-server-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-contour-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_data_foundation:4"
          ],
          "defaultStatus": "affected",
          "packageName": "odf4/rook-ceph-rhel8-operator",
          "product": "Red Hat Openshift Data Foundation 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster."
    },
    {
      "lang": "es",
      "value": " Se encontr\u00f3 una falla en el paquete cert-manager. Esta falla permite que un atacante que pueda modificar los datos PEM que lee el cert-manager, por ejemplo, en un recurso secreto, utilice grandes cantidades de CPU en el m\u00f3dulo controlador del cert-manager para crear efectivamente un vector de denegaci\u00f3n de servicio (DoS) para el cert-manager en el cl\u00faster."
    }
  ],
  "id": "CVE-2024-12401",
  "lastModified": "2026-06-26T05:16:25.573",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 3.6,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-12401",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-12-12T15:21:20.829376Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-12-12T09:15:05.790",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2024-12401"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327929"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/cert-manager/cert-manager/pull/7400"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/cert-manager/cert-manager/pull/7401"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/cert-manager/cert-manager/pull/7402"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/cert-manager/cert-manager/pull/7403"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://go.dev/issue/50116"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GHW8-3XQW-HHCJ

Vulnerability from github – Published: 2024-12-12 09:31 – Updated: 2024-12-12 19:19

Withdrawn 2024-12-12

Summary

Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references.

Original Description

Severity

4.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cert-manager/cert-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cert-manager/cert-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.13.0-alpha.0"
            },
            {
              "fixed": "1.15.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cert-manager/cert-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0-alpha.0"
            },
            {
              "fixed": "1.16.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-12401"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-12T19:19:49Z",
    "nvd_published_at": "2024-12-12T09:15:05Z",
    "severity": "MODERATE"
  },
  "details": "# Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r4pg-vg54-wxx4. This link is maintained to preserve external references.\n\n# Original Description\n\nA flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.",
  "id": "GHSA-ghw8-3xqw-hhcj",
  "modified": "2024-12-12T19:19:49Z",
  "published": "2024-12-12T09:31:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12401"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cert-manager/cert-manager/pull/7400"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cert-manager/cert-manager/pull/7401"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cert-manager/cert-manager/pull/7402"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cert-manager/cert-manager/pull/7403"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-12401"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327929"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cert-manager/cert-manager"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/50116"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs",
  "withdrawn": "2024-12-12T19:19:49Z"
}

MSRC_CVE-2024-12401

Vulnerability from csaf_microsoft - Published: 2024-12-02 00:00 - Updated: 2026-02-18 14:35

Summary

Cert-manager: potential dos when parsing specially crafted pem inputs

Scope

1 vulnerability in this advisory, including CVE-2024-12401.

CVE-2024-12401

4.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known affected: 4 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OPENSUSE-SU-2024:14599-1

Vulnerability from csaf_opensuse - Published: 2024-12-18 00:00 - Updated: 2026-09-20 21:22

Summary

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

Severity

Moderate

Scope

21 vulnerabilities in this advisory, including CVE-2024-12401.

CVE-2024-12401

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-12401 (GCVE-0-2024-12401)

CLEANSTART-2025-OY13195 (CVE-2024-12401)

CLEANSTART-2026-EP15881 (CVE-2022-1996)

CLEANSTART-2026-HV28992 (CVE-2022-1996)

FKIE_CVE-2024-12401

GHSA-GHW8-3XQW-HHCJ

Duplicate Advisory

Original Description

MSRC_CVE-2024-12401

OPENSUSE-SU-2024:14599-1

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour