Supply Chain Security

📋 Recommended Actions ✅ No Immediate Action Required No immediate action is required. However, reviewing these updates is recommended to benefit from improved stability, enhanced security, and to better support your users by understanding the strengthened supply chain integrity. 📝 Summary cert-manager v1.20.4 delivers crucial updates focused on strengthening security, improving controller stability, and hardening the release process. This patch release includes a critical fix for the certificate shim, preventing unintended mutation of cached Kubernetes objects—a vital step for controller reliability. You’ll also find a suite of dependency upgrades addressing various underlying security advisories, fortifying cert-manager’s overall supply chain posture. Significant enhancements to the release pipeline now incorporate Cosign signing for metadata, boosting integrity and trust. Furthermore, e2e tests are now more robust with retry mechanisms for Kyverno policy application and dynamic resolution of initial upgrade versions, ensuring a smoother development experience. Review these changes to leverage a more secure and stable cert-manager environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is highly recommended to address CVE-2024-24791 and benefit from the latest security patches in underlying dependencies. 📝 Summary cert-manager v1.18.6 delivers critical security enhancements, primarily addressing the CVE-2024-24791 vulnerability found in the Go standard library’s HTTP/2 implementation. This high-severity fix mitigates a potential denial-of-service risk, making an immediate upgrade essential for operational security. Beyond the Go toolchain bump to 1.24.13, this release also incorporates refreshed distroless base images (Debian 12). These updates bring the latest security patches from the Debian ecosystem, ensuring a more robust and secure runtime environment for your cert-manager deployments. No new features or breaking changes are introduced; this is a focused stability and security release. Operations engineers should prioritize this update to safeguard their Kubernetes clusters and maintain certificate issuance integrity. Review the release notes for full details. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address the OpenTelemetry security vulnerability (GO-2026-4394) and to benefit from the latest Go runtime and base image security updates. 📝 Summary Cert-manager v1.19.4 brings crucial security and maintenance updates, bolstering the reliability of your certificate management. This release addresses a medium-severity OpenTelemetry vulnerability (GO-2026-4394) related to sensitive data exposure in HTTP headers, making an upgrade vital for enhanced security posture. We’ve also updated the Go runtime to version 1.25.7, incorporating the latest performance improvements and bug fixes. Furthermore, all base images have been refreshed to Debian 12, ensuring cert-manager components run on the most current and secure foundations. These updates are essential for maintaining a stable and secure Kubernetes environment. Upgrade soon to protect your clusters and leverage these core improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address several security vulnerabilities in core dependencies and ensure the continued stability of your cert-manager deployments. This cert-manager v1.17.2 release delivers vital security updates by patching multiple Go dependencies that address various CVEs. Beyond these critical fixes, we’ve also refreshed our Go toolchain and base images, ensuring a more robust and secure foundation for your certificate management needs. ...