RBAC

📋 Recommended Actions ⚠️ Action Required Immediate patching is required to address critical security vulnerabilities. Operations engineers should review the RBAC changes, especially if directly manipulating ACME Challenge or Order resources, as this is a breaking change. 📝 Summary Cert-manager v1.19.6 lands with crucial security updates and hardened RBAC policies, fortifying your certificate management infrastructure. This release addresses three notable Go module vulnerabilities, including CVE-2023-3978 in golang.org/x/crypto and CVE-2023-39325 in github.com/moby/spdystream. These fixes bolster protection against denial-of-service attacks and improve overall system resilience. Additionally, a significant change restricts direct user interaction with ACME Challenge and Order resources. These Kubernetes objects, never intended for manual management, now have tighter controls on creation and modification verbs within the aggregate edit ClusterRole. This helps prevent misconfigurations and reinforces the intended operational model. Upgrading also bumps the Go runtime to v1.25.11 and updates base images, ensuring a more stable and secure environment. Review the RBAC changes to ensure no disruption if your workflows involve direct manipulation of ACME challenge/order resources, otherwise, upgrade promptly for a safer cert-manager deployment. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address multiple security vulnerabilities. Review RBAC changes for ACME Challenge and Order resources, especially if you have custom automation that directly manipulates these internal objects. 📝 Summary Cert-manager v1.20.3 delivers essential security updates and crucial internal refinements. This patch release addresses three vulnerabilities across core Go dependencies, including a high-severity HTTP/2 rapid reset variant in golang.org/x/net (CVE-2024-24783), and medium-severity fixes for golang.org/x/crypto (CVE-2024-24784) and github.com/moby/spdystream (CVE-2024-24785). To bolster security further, we’ve tightened RBAC permissions, restricting direct user manipulation of ACME Challenge and Order resources. Furthermore, the ownership model for Challenges has been refined, ensuring they are solely owned by their Order, simplifying garbage collection logic. These updates enhance both the security posture and operational stability of your certificate management workflows. Upgrade now to secure your clusters and leverage these improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required. Upgrade cert-manager to v1.20.1 to secure your deployments against a high-severity gRPC vulnerability and resolve critical RBAC issues. 📝 Summary Cert-manager v1.20.1 delivers vital updates, addressing a high-severity security vulnerability and crucial operational stability fixes. You’ll want to upgrade promptly to protect your clusters from CVE-2023-44487, an HTTP/2 Rapid Reset attack vulnerability in google.golang.org/grpc. This patch hardens cert-manager’s foundational security. Operations teams will also appreciate a critical RBAC fix, resolving an issue where cert-manager couldn’t properly update finalizers on Issuers and ClusterIssuers in Kubernetes environments with OwnerReferencesPermissionEnforcement enabled. This directly impacts certificate lifecycle management. Additionally, we’ve refined the Gateway API integration for ACME HTTP01 challenges, preventing duplicate ParentRefs from being added to HTTPRoutes, ensuring cleaner, more reliable configurations. Along with these significant improvements, v1.20.1 includes various other dependency updates, enhancing overall stability and performance. Don’t delay—secure your certificate management with this essential upgrade. ...

📋 Recommended Actions ⚠️ Action Required Immediate review of your cert-manager Helm chart deployment is required due to a significant RBAC reversion. Users relying on the ‘disableHTTPChallengesRole’ flag must update their manifests. Review the certificate name constraints fix to ensure correct certificate issuance. 📝 Summary cert-manager v1.18.2 lands with critical updates, most notably a significant reversion of RBAC changes introduced in v1.18.1. This patch release removes the global.rbac.disableHTTPChallengesRole Helm value, consolidating HTTP-01 and DNS-01 challenge-related ClusterRoles into a single, unified controller role. If your deployments relied on disableHTTPChallengesRole to limit permissions, you must immediately review and update your Helm manifests. This reversion effectively means that HTTP-01 challenge permissions, such as creating pods and services, are now always included within the primary challenge controller role, potentially granting broader permissions than you previously configured or intended. Beyond RBAC, this release also delivers a crucial bug fix. It corrects an issue where certificate name constraints for URI domains were being mistakenly interpreted as ExcludedURIDomains instead of PermittedURIDomains in generated Certificate Signing Requests. This fix ensures that your certificates are issued with the exact URI name constraints you specify, preventing unexpected validation failures. Operations engineers should promptly examine their Helm values and RBAC configurations to prevent unintended permission shifts and ensure correct certificate issuance behavior. ...