Security Fix

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address multiple security vulnerabilities. Review RBAC changes for ACME Challenge and Order resources, especially if you have custom automation that directly manipulates these internal objects. 📝 Summary Cert-manager v1.20.3 delivers essential security updates and crucial internal refinements. This patch release addresses three vulnerabilities across core Go dependencies, including a high-severity HTTP/2 rapid reset variant in golang.org/x/net (CVE-2024-24783), and medium-severity fixes for golang.org/x/crypto (CVE-2024-24784) and github.com/moby/spdystream (CVE-2024-24785). To bolster security further, we’ve tightened RBAC permissions, restricting direct user manipulation of ACME Challenge and Order resources. Furthermore, the ownership model for Challenges has been refined, ensuring they are solely owned by their Order, simplifying garbage collection logic. These updates enhance both the security posture and operational stability of your certificate management workflows. Upgrade now to secure your clusters and leverage these improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address CVE-2024-29018, a high-severity vulnerability in the gRPC dependency. Review updated E2E testing procedures if you maintain custom CI workflows. 📝 Summary cert-manager v1.19.5 delivers essential security and maintenance updates, crucial for maintaining a robust certificate management infrastructure. This release directly addresses CVE-2024-29018, a high-severity vulnerability in the gRPC dependency that could lead to CPU exhaustion. Upgrading promptly is vital to protect your systems. Beyond security, we’ve bumped the core Go runtime to version 1.25.9 and updated numerous transitive dependencies like golang.org/x/crypto and cel.dev/expr to ensure improved stability and performance. Internal CI/CD workflows also see significant enhancements, including support for Kubernetes 1.35 and a migration of upgrade E2E tests to leverage Helm OCI registries. Minor textual cleanups in CRD descriptions also enhance clarity. These updates balance critical security fixes with ongoing platform compatibility and foundational improvements. Upgrade to secure your deployments and benefit from these stability enhancements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is required. This release addresses critical security vulnerabilities in core dependencies like go-jose and the Go runtime. Upgrade promptly to protect your cert-manager deployments. 📝 Summary cert-manager v1.20.2 lands with crucial security fixes and essential dependency updates. This patch release tackles CVE-2024-28180, a critical authentication bypass in the underlying go-jose library. Furthermore, it incorporates Go runtime v1.26.2, which includes fixes for high-severity issues like CVE-2024-24791 (TLS DoS) and CVE-2024-24792 (HTTP/2 memory exhaustion). These updates are vital for maintaining the integrity and availability of your certificate management infrastructure. You’ll also find updated OpenTelemetry libraries, improving observability foundations, and a minor Helm chart indentation fix. Upgrade quickly to secure your clusters. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required. Upgrade cert-manager to v1.20.1 to secure your deployments against a high-severity gRPC vulnerability and resolve critical RBAC issues. 📝 Summary Cert-manager v1.20.1 delivers vital updates, addressing a high-severity security vulnerability and crucial operational stability fixes. You’ll want to upgrade promptly to protect your clusters from CVE-2023-44487, an HTTP/2 Rapid Reset attack vulnerability in google.golang.org/grpc. This patch hardens cert-manager’s foundational security. Operations teams will also appreciate a critical RBAC fix, resolving an issue where cert-manager couldn’t properly update finalizers on Issuers and ClusterIssuers in Kubernetes environments with OwnerReferencesPermissionEnforcement enabled. This directly impacts certificate lifecycle management. Additionally, we’ve refined the Gateway API integration for ACME HTTP01 challenges, preventing duplicate ParentRefs from being added to HTTPRoutes, ensuring cleaner, more reliable configurations. Along with these significant improvements, v1.20.1 includes various other dependency updates, enhancing overall stability and performance. Don’t delay—secure your certificate management with this essential upgrade. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is highly recommended to address CVE-2024-24791 and benefit from the latest security patches in underlying dependencies. 📝 Summary cert-manager v1.18.6 delivers critical security enhancements, primarily addressing the CVE-2024-24791 vulnerability found in the Go standard library’s HTTP/2 implementation. This high-severity fix mitigates a potential denial-of-service risk, making an immediate upgrade essential for operational security. Beyond the Go toolchain bump to 1.24.13, this release also incorporates refreshed distroless base images (Debian 12). These updates bring the latest security patches from the Debian ecosystem, ensuring a more robust and secure runtime environment for your cert-manager deployments. No new features or breaking changes are introduced; this is a focused stability and security release. Operations engineers should prioritize this update to safeguard their Kubernetes clusters and maintain certificate issuance integrity. Review the release notes for full details. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is recommended to address a high-severity DNS-01 solver stability issue (GHSA-gx3x-vq4p-mhhv) and ensure robust certificate issuance validation. 📝 Summary Cert-manager v1.18.5 delivers critical updates. It fixes a high-severity DNS-01 solver panic (GHSA-gx3x-vq4p-mhhv), preventing service disruptions. It also adds robust validation for issued certificates, ensuring public keys match CSRs, and improves HTTP-01 IPv6 handling. Upgrade now for enhanced stability and security! 🔒 High-Severity Fix: ACME DNS-01 Solver Panic (GHSA-gx3x-vq4p-mhhv) A critical vulnerability identified as GHSA-gx3x-vq4p-mhhv has been addressed in this release, preventing potential denial-of-service scenarios for the ACME DNS-01 solver. Previously, the solver would incorrectly assume that DNS SOA records would always be the first entry in a DNS query response. If a DNS provider returned the SOA record at a different position, cert-manager’s DNS-01 solver could panic and crash, making it unable to process new challenges and disrupting certificate issuance. ...

📋 Recommended Actions ⚠️ Action Required Immediate review recommended for all users. Upgrade promptly to benefit from critical security hardening, fix potential denial-of-service vectors, and enhance certificate issuance reliability. 📝 Summary cert-manager v1.19.3 delivers crucial security enhancements and improved issuance robustness. This release directly addresses GHSA-gx3x-vq4p-mhhv, preventing a potential panic in the ACME DNS solver that could lead to denial-of-service. This high-severity fix solidifies the reliability of your ACME challenges. We’ve also introduced a vital new check: certificate issuance will now fail if the public key in the signed certificate doesn’t match the original Certificate Signing Request (CSR). This prevents infinite re-issuance loops with misconfigured external issuers, ensuring cryptographic integrity. Furthermore, the HTTP-01 solver gained more robust handling of IPv6 address literals, improving compliance and reliability for diverse network configurations. Essential tooling updates, including Go 1.25.6 and Kind 0.31.0, round out this focused release. Upgrade to boost the security and stability of your certificate management. ...

📋 Recommended Actions ⚠️ Action Required Immediate review is required due to security enhancements for Gateway API TLS secret access. Operations engineers should update to ensure gateways continue to function correctly, especially if relying on previous implicit permissions. Also, review the new ENABLE_PROXY_FIND_POD_BY_IP flag for potential future impacts. 📝 Summary Istio 1.26.5 delivers crucial security and stability enhancements. This release significantly hardens Kubernetes Gateway API TLS secret access, now requiring both namespace and service account matching for referenced secrets—a vital update for secure operations. You’ll also find improved installation flexibility as the Istio CNI no longer depends directly on Pilot, streamlining deployments. For ambient mode users, ServiceEntry named port mapping logic is now correctly aligned with sidecar behavior, resolving previous inconsistencies. Additionally, a new feature flag, ENABLE_PROXY_FIND_POD_BY_IP, grants more control over pod-proxy association, with future versions defaulting it to ‘off’. Critical bug fixes address issues like XDS cache corruption during SDS config dumps and Gateway API meshconfig reconciliation, ensuring a more robust and predictable service mesh. Review these updates promptly to maintain a secure and efficient Istio environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade recommended to ensure certificate name constraints are correctly applied, enhancing the security and validity of issued certificates. cert-manager v1.17.4 is a targeted patch release addressing a critical bug in how URI name constraints are applied during certificate signing request (CSR) generation. Previously, Permitted.URIDomains were incorrectly treated as excluded, potentially leading to misconfigurations in certificate issuance policies. This fix ensures that your defined URI name constraints are honored as intended, bolstering the integrity and security of your issued certificates. ...