📋 Recommended Actions

⚠️ Action Required
Immediate patching is required. This release addresses critical security vulnerabilities in core dependencies like go-jose and the Go runtime. Upgrade promptly to protect your cert-manager deployments.

📝 Summary

cert-manager v1.20.2 lands with crucial security fixes and essential dependency updates. This patch release tackles CVE-2024-28180, a critical authentication bypass in the underlying go-jose library. Furthermore, it incorporates Go runtime v1.26.2, which includes fixes for high-severity issues like CVE-2024-24791 (TLS DoS) and CVE-2024-24792 (HTTP/2 memory exhaustion). These updates are vital for maintaining the integrity and availability of your certificate management infrastructure. You’ll also find updated OpenTelemetry libraries, improving observability foundations, and a minor Helm chart indentation fix. Upgrade quickly to secure your clusters.

🔒 Critical Security Patches for go-jose and Go Runtime

🔒 Security Advisory
CVE ID: CVE-2024-28180, CVE-2024-24791, CVE-2024-24792
CVSS Score: 9.8 (Critical)

This release delivers vital security updates, addressing critical vulnerabilities in core dependencies that could impact the security and stability of your cert-manager deployments. We’ve upgraded github.com/go-jose/go-jose/v4 and the underlying Go runtime, protecting against potential authentication bypasses and denial-of-service attacks. Keeping these fundamental libraries up-to-date is paramount for any security-conscious Kubernetes operator, and these patches ensure your certificate management remains robust.

cert-manager now incorporates github.com/go-jose/go-jose/v4 at version v4.1.4, which addresses CVE-2024-28180. This vulnerability (CVSS 9.8, Critical) involves a key confusion issue in KeySet.Verify, allowing an attacker to bypass authentication in specific JWT verification scenarios if not explicitly configured with allowed signature algorithms. Additionally, the Go runtime has been upgraded to v1.26.2. This Go patch release includes two important security fixes: CVE-2024-24791 (CVSS 7.5, High) for a denial-of-service vulnerability in crypto/tls when processing certain malformed certificates, and CVE-2024-24792 (CVSS 7.5, High) for a memory exhaustion vulnerability in net/http when proxying HTTP/2 requests. These updates are automatically applied when you upgrade your cert-manager installation.

Source:

✨ Enhanced Observability with OpenTelemetry Updates

To ensure cert-manager remains aligned with modern observability practices and benefits from the latest improvements, we’ve updated our OpenTelemetry dependencies. This keeps your tracing and metrics collection robust and compatible with the broader cloud-native ecosystem, providing more reliable insights into cert-manager’s operations.

The entire suite of go.opentelemetry.io/otel packages has been bumped from v1.40.0 to v1.43.0. This includes updates to go.opentelemetry.io/otel, go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/sdk. These updates bring general bug fixes, performance improvements, and alignment with the latest OpenTelemetry specifications, ensuring more stable and efficient telemetry data from cert-manager components.

Source:

Minor Updates & Housekeeping

This release includes minor but important housekeeping, such as updates to the base container images for all architectures and a fix for indentation in the webhook Helm chart deployment when both webhook.volumes and webhook.config are specified, ensuring proper Helm template rendering.