Denial of Service

📋 Recommended Actions ⚠️ Action Required Immediate patching is required. This release addresses critical security vulnerabilities in core dependencies like go-jose and the Go runtime. Upgrade promptly to protect your cert-manager deployments. 📝 Summary cert-manager v1.20.2 lands with crucial security fixes and essential dependency updates. This patch release tackles CVE-2024-28180, a critical authentication bypass in the underlying go-jose library. Furthermore, it incorporates Go runtime v1.26.2, which includes fixes for high-severity issues like CVE-2024-24791 (TLS DoS) and CVE-2024-24792 (HTTP/2 memory exhaustion). These updates are vital for maintaining the integrity and availability of your certificate management infrastructure. You’ll also find updated OpenTelemetry libraries, improving observability foundations, and a minor Helm chart indentation fix. Upgrade quickly to secure your clusters. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required. Upgrade cert-manager to v1.20.1 to secure your deployments against a high-severity gRPC vulnerability and resolve critical RBAC issues. 📝 Summary Cert-manager v1.20.1 delivers vital updates, addressing a high-severity security vulnerability and crucial operational stability fixes. You’ll want to upgrade promptly to protect your clusters from CVE-2023-44487, an HTTP/2 Rapid Reset attack vulnerability in google.golang.org/grpc. This patch hardens cert-manager’s foundational security. Operations teams will also appreciate a critical RBAC fix, resolving an issue where cert-manager couldn’t properly update finalizers on Issuers and ClusterIssuers in Kubernetes environments with OwnerReferencesPermissionEnforcement enabled. This directly impacts certificate lifecycle management. Additionally, we’ve refined the Gateway API integration for ACME HTTP01 challenges, preventing duplicate ParentRefs from being added to HTTPRoutes, ensuring cleaner, more reliable configurations. Along with these significant improvements, v1.20.1 includes various other dependency updates, enhancing overall stability and performance. Don’t delay—secure your certificate management with this essential upgrade. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is highly recommended to address CVE-2024-24791 and benefit from the latest security patches in underlying dependencies. 📝 Summary cert-manager v1.18.6 delivers critical security enhancements, primarily addressing the CVE-2024-24791 vulnerability found in the Go standard library’s HTTP/2 implementation. This high-severity fix mitigates a potential denial-of-service risk, making an immediate upgrade essential for operational security. Beyond the Go toolchain bump to 1.24.13, this release also incorporates refreshed distroless base images (Debian 12). These updates bring the latest security patches from the Debian ecosystem, ensuring a more robust and secure runtime environment for your cert-manager deployments. No new features or breaking changes are introduced; this is a focused stability and security release. Operations engineers should prioritize this update to safeguard their Kubernetes clusters and maintain certificate issuance integrity. Review the release notes for full details. ...

📋 Recommended Actions ⚠️ Action Required Immediate review recommended for all users. Upgrade promptly to benefit from critical security hardening, fix potential denial-of-service vectors, and enhance certificate issuance reliability. 📝 Summary cert-manager v1.19.3 delivers crucial security enhancements and improved issuance robustness. This release directly addresses GHSA-gx3x-vq4p-mhhv, preventing a potential panic in the ACME DNS solver that could lead to denial-of-service. This high-severity fix solidifies the reliability of your ACME challenges. We’ve also introduced a vital new check: certificate issuance will now fail if the public key in the signed certificate doesn’t match the original Certificate Signing Request (CSR). This prevents infinite re-issuance loops with misconfigured external issuers, ensuring cryptographic integrity. Furthermore, the HTTP-01 solver gained more robust handling of IPv6 address literals, improving compliance and reliability for diverse network configurations. Essential tooling updates, including Go 1.25.6 and Kind 0.31.0, round out this focused release. Upgrade to boost the security and stability of your certificate management. ...