📋 Recommended Actions

⚠️ Action Required
Immediate patching is required to address critical security vulnerabilities. Operations engineers should review the RBAC changes, especially if directly manipulating ACME Challenge or Order resources, as this is a breaking change.

📝 Summary

Cert-manager v1.19.6 lands with crucial security updates and hardened RBAC policies, fortifying your certificate management infrastructure. This release addresses three notable Go module vulnerabilities, including CVE-2023-3978 in golang.org/x/crypto and CVE-2023-39325 in github.com/moby/spdystream. These fixes bolster protection against denial-of-service attacks and improve overall system resilience. Additionally, a significant change restricts direct user interaction with ACME Challenge and Order resources. These Kubernetes objects, never intended for manual management, now have tighter controls on creation and modification verbs within the aggregate edit ClusterRole. This helps prevent misconfigurations and reinforces the intended operational model. Upgrading also bumps the Go runtime to v1.25.11 and updates base images, ensuring a more stable and secure environment. Review the RBAC changes to ensure no disruption if your workflows involve direct manipulation of ACME challenge/order resources, otherwise, upgrade promptly for a safer cert-manager deployment.

🔒 Critical Security Updates for Go Modules

🔒 Security Advisory
CVE ID: CVE-2023-3978, CVE-2023-39325
CVSS Score: 5.9 (Medium)

This release delivers essential security fixes by updating several key Go modules, safeguarding cert-manager deployments from known vulnerabilities. By incorporating these upstream patches, we’re reducing the attack surface and enhancing the stability of your certificate issuance processes. These updates are crucial for maintaining a robust and secure cloud-native environment, protecting against potential denial-of-service (DoS) and other security exploits.

Cert-manager now uses golang.org/x/crypto at version v0.52.0, which includes a fix for CVE-2023-3978, addressing a panic vulnerability in ssh.ParseKnownHosts. The github.com/moby/spdystream module has been updated to v0.5.1, patching CVE-2023-39325, a low-severity DoS vulnerability related to resource exhaustion. Additionally, golang.org/x/net has been upgraded to v0.55.0 to incorporate general security hardening and cumulative fixes. These dependency bumps ensure cert-manager operates with the latest security best practices.

diff --git a/go.mod b/go.mod
index 1feb2c6bb..8c1ce1638 100644
--- a/go.mod
+++ b/go.mod
@@ -34,7 +34,7 @@ require (
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.49.0
+	golang.org/x/crypto v0.52.0
 	golang.org/x/oauth2 v0.34.0
 	golang.org/x/sync v0.20.0
 	google.golang.org/api v0.251.0

Source:

⚠️ Hardened RBAC for ACME Resources

To enhance security and enforce intended usage patterns, this release introduces stricter Role-Based Access Control (RBAC) permissions for ACME Challenge and Order resources. These resources are primarily internal to cert-manager’s operation and are not designed for direct user creation or modification. By restricting these verbs in the aggregate edit ClusterRole, we prevent accidental or malicious direct manipulation, thus improving the overall integrity and reliability of the certificate issuance workflow.

The edit ClusterRole now explicitly removes the create verb for challenges and the create, patch, and update verbs for orders. While patch and update verbs for challenges are retained to allow for necessary finalizer removal in edge cases, the intent is clear: users should interact with Certificates and Issuers or ClusterIssuers directly, allowing cert-manager to manage the underlying ACME process. If your existing automation or user workflows directly create or modify these ACME resources, this change is breaking and will require adjustments.

Before:

  - apiGroups: ["acme.cert-manager.io"]
    resources: ["challenges", "orders"]
    verbs: ["create", "delete", "deletecollection", "patch", "update"]

After:

  - apiGroups: ["acme.cert-manager.io"]
    resources: ["challenges"]
    verbs: ["delete", "deletecollection", "patch", "update"]
  - apiGroups: ["acme.cert-manager.io"]
    resources: ["orders"]
    verbs: ["delete", "deletecollection"]

Action Required: Review any custom roles or automations that might be directly interacting with acme.cert-manager.io/v1beta1 Challenge or Order resources and adjust them to adhere to the new permissions.

Source:

  • deploy/charts/cert-manager/templates/rbac.yaml (511-525)

Minor Updates & Housekeeping

This release also bumps the Go runtime to v1.25.11 and updates all base images to their latest Debian 12 stable versions, ensuring a more consistent and secure build environment. Additionally, various other Go module dependencies received minor updates.