{"id":"CVE-2024-12401","state":"PUBLISHED","title":"Cert-manager: potential dos when parsing specially crafted pem inputs","description":"A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.","publishedAt":"2024-12-12T09:06:03.612Z","updatedAt":"2026-06-26T04:27:26.590Z","severity":{"score":4.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["cert-manager","Red Hat cert-manager Operator for Red Hat OpenShift","Red Hat Cryostat 3","Red Hat Multicluster Engine for Kubernetes","Red Hat OpenShift Serverless","Red Hat Red Hat Connectivity Link 1","Red Hat Red Hat OpenShift Container Platform 4","Red Hat Red Hat Openshift Data Foundation 4","Red Hat Red Hat OpenShift GitOps"],"affected":[{"packageName":"cert-manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.12.14","versionType":"semver"},{"version":"1.13.0-alpha.0","status":"affected","lessThanOrEqual":"1.15.4","versionType":"semver"},{"version":"1.16.0-alpha.0","status":"affected","lessThanOrEqual":"1.16.2","versionType":"semver"}],"collectionURL":"https://github.com/cert-manager/cert-manager"},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager/jetstack-cert-manager-acmesolver-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager/jetstack-cert-manager-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager-operator-bundle-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager-operator-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"Cryostat 3","packageName":"cryostat-tech-preview/cryostat-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cryostat:3"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-8-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-9-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-activator-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-autoscaler-hpa-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-autoscaler-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-controller-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-queue-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-storage-version-migration-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-webhook-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"Red Hat Connectivity Link 1","packageName":"rhcl-operator-bundle-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:connectivity_link:1"]},{"vendor":"Red Hat","product":"Red Hat Connectivity Link 1","packageName":"rhcl-operator-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:connectivity_link:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-api-server-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-contour-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/rook-ceph-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/gitops-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]}],"references":["https://access.redhat.com/security/cve/CVE-2024-12401","https://bugzilla.redhat.com/show_bug.cgi?id=2327929","https://github.com/cert-manager/cert-manager/pull/7400","https://github.com/cert-manager/cert-manager/pull/7401","https://github.com/cert-manager/cert-manager/pull/7402","https://github.com/cert-manager/cert-manager/pull/7403","https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4","https://go.dev/issue/50116"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12401.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-12401","state":"PUBLISHED","datePublished":"2024-12-12T09:06:03.612Z","dateUpdated":"2026-06-26T04:27:26.590Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-12-10T13:30:10.806Z"},"containers":{"cna":{"title":"Cert-manager: potential dos when parsing specially crafted pem inputs","descriptions":[{"lang":"en","value":"A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster."}],"affected":[{"packageName":"cert-manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.12.14","versionType":"semver"},{"version":"1.13.0-alpha.0","status":"affected","lessThanOrEqual":"1.15.4","versionType":"semver"},{"version":"1.16.0-alpha.0","status":"affected","lessThanOrEqual":"1.16.2","versionType":"semver"}],"collectionURL":"https://github.com/cert-manager/cert-manager"},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager/jetstack-cert-manager-acmesolver-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager/jetstack-cert-manager-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager-operator-bundle-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"cert-manager Operator for Red Hat OpenShift","packageName":"cert-manager-operator-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cert_manager:1"]},{"vendor":"Red Hat","product":"Cryostat 3","packageName":"cryostat-tech-preview/cryostat-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cryostat:3"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-8-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","packageName":"multicluster-engine/assisted-service-9-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-activator-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-autoscaler-hpa-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-autoscaler-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-controller-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-queue-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-storage-version-migration-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"openshift-serverless-1/serving-webhook-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"Red Hat Connectivity Link 1","packageName":"rhcl-operator-bundle-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:connectivity_link:1"]},{"vendor":"Red Hat","product":"Red Hat Connectivity Link 1","packageName":"rhcl-operator-container","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:connectivity_link:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-api-server-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-contour-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/rook-ceph-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/gitops-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-12401","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2327929","name":"RHBZ#2327929","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/cert-manager/cert-manager/pull/7400"},{"url":"https://github.com/cert-manager/cert-manager/pull/7401"},{"url":"https://github.com/cert-manager/cert-manager/pull/7402"},{"url":"https://github.com/cert-manager/cert-manager/pull/7403"},{"url":"https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"},{"url":"https://go.dev/issue/50116"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-26T04:27:26.590Z"},"datePublic":"2024-11-21T19:52:52.000Z","x_redhatCweChain":"CWE-20: Improper Input Validation","timeline":[{"lang":"en","time":"2024-11-21T23:00:43.367Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-11-21T19:52:52.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-12T15:21:20.829376Z","id":"CVE-2024-12401","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-12T15:44:58.794Z"}}]}}}