CVE-2024-12401
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A flaw was found in the cert-manager package that allows an attacker who can modify PEM data read by cert-manager (e.g., in a Secret resource) to cause high CPU usage in the cert-manager controller pod, leading to a denial-of-service (DoS) vector for cert-manager in the cluster.
Risk Assessment
The risk is the possibility of a DoS attack on cert-manager, which can disrupt certificate management in the Kubernetes cluster and affect the availability of services dependent on certificates.
Recommendation
It is recommended to restrict access to Secret resources and other PEM data sources read by cert-manager, and to monitor CPU usage in the controller pod to detect potential attacks.
Original NVD description (English source)
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.