📋 Recommended Actions
⚠️ Action Required
Immediate patching required. Upgrade cert-manager to v1.20.1 to secure your deployments against a high-severity gRPC vulnerability and resolve critical RBAC issues.
📝 Summary
Cert-manager v1.20.1 delivers vital updates, addressing a high-severity security vulnerability and crucial operational stability fixes. You’ll want to upgrade promptly to protect your clusters from CVE-2023-44487, an HTTP/2 Rapid Reset attack vulnerability in google.golang.org/grpc. This patch hardens cert-manager’s foundational security. Operations teams will also appreciate a critical RBAC fix, resolving an issue where cert-manager couldn’t properly update finalizers on Issuers and ClusterIssuers in Kubernetes environments with OwnerReferencesPermissionEnforcement enabled. This directly impacts certificate lifecycle management. Additionally, we’ve refined the Gateway API integration for ACME HTTP01 challenges, preventing duplicate ParentRefs from being added to HTTPRoutes, ensuring cleaner, more reliable configurations. Along with these significant improvements, v1.20.1 includes various other dependency updates, enhancing overall stability and performance. Don’t delay—secure your certificate management with this essential upgrade.
🔒 Critical Security Fix: HTTP/2 Rapid Reset Vulnerability in gRPC (CVE-2023-44487)
🔒 Security Advisory
CVE ID: CVE-2023-44487
CVSS Score: 7.5 (High)
Security is paramount, and cert-manager v1.20.1 delivers a critical patch for a high-severity vulnerability. We’ve updated the google.golang.org/grpc dependency to v1.79.3 to address CVE-2023-44487, a significant HTTP/2 Rapid Reset attack that could lead to denial of service. This update ensures your cert-manager components are hardened against this exploit, safeguarding your Kubernetes clusters.
The fix is included by bumping the google.golang.org/grpc module to version v1.79.3 across all cert-manager components, including the controller, webhook, acmesolver, cainjector, and startupapicheck. No user-facing configuration changes are required; simply upgrading cert-manager will apply the patch. This ensures all internal gRPC communications and external interactions using gRPC are protected.
Source:
cmd/controller/go.mod(173)cmd/webhook/go.mod(79)go.mod(186)cmd/acmesolver/go.mod(40-49)cmd/cainjector/go.mod(62-72)cmd/startupapicheck/go.mod(69-79)
🐛 RBAC Fix: OwnerReferencesPermissionEnforcement for Issuers/ClusterIssuers
For clusters running with Kubernetes’s OwnerReferencesPermissionEnforcement enabled, cert-manager previously faced an operational hurdle: it couldn’t properly update finalizers on Issuers and ClusterIssuers. This release resolves that critical issue, ensuring seamless lifecycle management of your certificate authorities and removing a potential blocker for robust cluster security policies.
The fix involves a small but crucial update to the cert-manager RBAC configuration within its Helm chart. We’ve added the update verb for clusterissuers/finalizers and issuers/finalizers to the cert-manager.io API group. This grants the necessary permissions for the controller to manage these resources correctly.yaml# Excerpt from deploy/charts/cert-manager/templates/rbac.yamlrules: # ... existing rules ... - apiGroups: ["cert-manager.io"] resources: ["clusterissuers/finalizers", "issuers/finalizers"] verbs: ["update"]This change means that cert-manager can now reliably clean up resources and prevent orphaned objects, even in highly secured cluster environments.
Source:
deploy/charts/cert-manager/templates/rbac.yaml(208-210)
✨ Gateway API: Preventing Duplicate ParentRefs in ACME HTTP01 Challenges
Streamlining your ACME HTTP01 challenge configurations, especially when using the Gateway API, is a key focus. This update significantly improves how cert-manager handles ParentRefs, preventing redundant entries from being added to your HTTPRoute resources. This refinement ensures a cleaner, more predictable configuration, reducing potential for misconfigurations and improving the reliability of certificate issuance.
The logic within the applyGatewayAPIAnnotationParentRefOverride function has been enhanced. Previously, if an Issuer’s configuration already defined a ParentRef and an annotation on an Order also specified a matching ParentRef, cert-manager would add a duplicate. Now, the system intelligently filters out any existing ParentRefs that match the annotation-driven override before applying the new one.go// Simplified logic excerpt// filtered = make([]gwapi.ParentReference, 0, len(s.HTTP01.GatewayHTTPRoute.ParentRefs))// for _, pr := range s.HTTP01.GatewayHTTPRoute.ParentRefs {// if ! (sameNamespace && sameName && sameKind) { // check for duplicates// filtered = append(filtered, pr)// }// }// filtered = append(filtered, newParentRefFromAnnotation)// s.HTTP01.GatewayHTTPRoute.ParentRefs = filteredThis ensures that regardless of whether ParentRefs are defined via Issuer configuration or annotations, the resulting HTTPRoute will contain only a single, effective ParentReference for the specified Gateway.
Source:
Minor Updates & Housekeeping
This release also incorporates routine dependency updates for various golang.org/x modules (like x/net, x/sys, x/crypto, x/sync, x/term, x/mod, and x/text). These updates ensure cert-manager stays current with the Go ecosystem, bringing general stability improvements and keeping its underlying libraries secure.