PKI

📋 Recommended Actions ⚠️ Action Required Immediate patching required. Upgrade cert-manager to v1.20.1 to secure your deployments against a high-severity gRPC vulnerability and resolve critical RBAC issues. 📝 Summary Cert-manager v1.20.1 delivers vital updates, addressing a high-severity security vulnerability and crucial operational stability fixes. You’ll want to upgrade promptly to protect your clusters from CVE-2023-44487, an HTTP/2 Rapid Reset attack vulnerability in google.golang.org/grpc. This patch hardens cert-manager’s foundational security. Operations teams will also appreciate a critical RBAC fix, resolving an issue where cert-manager couldn’t properly update finalizers on Issuers and ClusterIssuers in Kubernetes environments with OwnerReferencesPermissionEnforcement enabled. This directly impacts certificate lifecycle management. Additionally, we’ve refined the Gateway API integration for ACME HTTP01 challenges, preventing duplicate ParentRefs from being added to HTTPRoutes, ensuring cleaner, more reliable configurations. Along with these significant improvements, v1.20.1 includes various other dependency updates, enhancing overall stability and performance. Don’t delay—secure your certificate management with this essential upgrade. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. This release primarily provides stability and quality-of-life improvements. Review the updates to leverage enhanced certificate handling and improve your troubleshooting experience. 📝 Summary cert-manager(v1.18.3) boosts reliability and user experience. It now supports significantly larger certificates and chains, crucial for complex deployments with many SANs. A critical fix prevents unnecessary certificate re-issuance stemming from IssuerRef defaulting. Plus, clearer error messages for malformed PEM data greatly simplify troubleshooting. Upgrade for a more stable and robust certificate management experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade recommended to ensure certificate name constraints are correctly applied, enhancing the security and validity of issued certificates. cert-manager v1.17.4 is a targeted patch release addressing a critical bug in how URI name constraints are applied during certificate signing request (CSR) generation. Previously, Permitted.URIDomains were incorrectly treated as excluded, potentially leading to misconfigurations in certificate issuance policies. This fix ensures that your defined URI name constraints are honored as intended, bolstering the integrity and security of your issued certificates. ...