GHSA-r4pg-vg54-wxx4PublishedWithdrawn

Cert-manager: potential dos when parsing specially crafted pem inputs

cve-program · CVE-2024-12401

Published

cert-manager

https://github.com/cert-manager/cert-manager

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver",
                            "lessThanOrEqual": "1.12.14"
                        },
                        {
                            "status": "affected",
                            "version": "1.13.0-alpha.0",
                            "versionType": "semver",
                            "lessThanOrEqual": "1.15.4"
                        },
                        {
                            "status": "affected",
                            "version": "1.16.0-alpha.0",
                            "versionType": "semver",
                            "lessThanOrEqual": "1.16.2"
                        }
                    ],
                    "packageName": "cert-manager",
                    "collectionURL": "https://github.com/cert-manager/cert-manager",
                    "defaultStatus": "unaffected"
                }

cert-manager/jetstack-cert-manager-acmesolver-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "cert-manager Operator for Red Hat OpenShift",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cert-manager/jetstack-cert-manager-acmesolver-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:cert_manager:1"
                    ]
                }

cert-manager/jetstack-cert-manager-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "cert-manager Operator for Red Hat OpenShift",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cert-manager/jetstack-cert-manager-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:cert_manager:1"
                    ]
                }

cert-manager-operator-bundle-container

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "cert-manager Operator for Red Hat OpenShift",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cert-manager-operator-bundle-container",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:cert_manager:1"
                    ]
                }

cert-manager-operator-container

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "cert-manager Operator for Red Hat OpenShift",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "cert-manager-operator-container",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:cert_manager:1"
                    ]
                }

cryostat-tech-preview/cryostat-rhel8-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Cryostat 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "cryostat-tech-preview/cryostat-rhel8-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:cryostat:3"
                    ]
                }

multicluster-engine/assisted-service-8-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Multicluster Engine for Kubernetes",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "multicluster-engine/assisted-service-8-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:multicluster_engine"
                    ]
                }

multicluster-engine/assisted-service-9-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Multicluster Engine for Kubernetes",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "multicluster-engine/assisted-service-9-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:multicluster_engine"
                    ]
                }

openshift-serverless-1/serving-activator-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-activator-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

openshift-serverless-1/serving-autoscaler-hpa-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-autoscaler-hpa-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

openshift-serverless-1/serving-autoscaler-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-autoscaler-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

openshift-serverless-1/serving-controller-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-controller-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

openshift-serverless-1/serving-queue-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-queue-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

openshift-serverless-1/serving-storage-version-migration-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-storage-version-migration-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

openshift-serverless-1/serving-webhook-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "OpenShift Serverless",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-serverless-1/serving-webhook-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:serverless:1"
                    ]
                }

rhcl-operator-bundle-container

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Connectivity Link 1",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhcl-operator-bundle-container",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:connectivity_link:1"
                    ]
                }

rhcl-operator-container

https://catalog.redhat.com/software/containers/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Connectivity Link 1",
                    "collectionURL": "https://catalog.redhat.com/software/containers/",
                    "packageName": "rhcl-operator-container",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:connectivity_link:1"
                    ]
                }

openshift4/ose-agent-installer-api-server-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift4/ose-agent-installer-api-server-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

openshift4/ose-contour-rhel8

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift Container Platform 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift4/ose-contour-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift:4"
                    ]
                }

odf4/rook-ceph-rhel8-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Openshift Data Foundation 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "odf4/rook-ceph-rhel8-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_data_foundation:4"
                    ]
                }

openshift-gitops-1/gitops-rhel8-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat OpenShift GitOps",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "openshift-gitops-1/gitops-rhel8-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:openshift_gitops:1"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2024-3471

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Dec 12, 2024, 9:06:03 AM

dateUpdated: Jun 26, 2026, 4:27:26 AM

2 related source bulletins · separate from aliases

msrc_CVE-2024-12401: Cert-manager: potential dos when parsing specially crafted pem inputs

CVE-2024-12401

openSUSE-SU-2024:14599-1: govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media

CVE-2020-10696 · CVE-2020-8912 · CVE-2022-31668 · CVE-2023-26248 · CVE-2023-3676 · CVE-2023-3955 · CVE-2024-12401 · CVE-2024-37032 · CVE-2024-44337 · CVE-2024-45039 · CVE-2024-45337 · CVE-2024-45436 · CVE-2024-46455 · CVE-2024-46528 · CVE-2024-53257 · CVE-2024-53859 · CVE-2024-55601 · CVE-2024-55657 · CVE-2024-55658 · CVE-2024-55659 · CVE-2024-55660

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2024-12401

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-20

Original publisher date fields

published: 2024-12-12T09:15:05.790

lastModified: 2026-06-26T05:16:25.573

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-ghw8-3xqw-hhcj

Withdrawn

github.com/cert-manager/cert-manager

SEMVER · introduced 0 → fixed 1.12.14

github.com/cert-manager/cert-manager

SEMVER · introduced 1.13.0-alpha.0 → fixed 1.15.4

github.com/cert-manager/cert-manager

SEMVER · introduced 1.16.0-alpha.0 → fixed 1.16.2

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-r4pg-vg54-wxx4

Published

github.com/cert-manager/cert-manager

SEMVER · introduced 0 → fixed 1.12.14

github.com/cert-manager/cert-manager

SEMVER · introduced 1.13.0-alpha.0 → fixed 1.15.4

github.com/cert-manager/cert-manager

SEMVER · introduced 1.16.0-alpha.0 → fixed 1.16.2

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2024-3282

Published

github.com/cert-manager/cert-manager

SEMVER · introduced 0 → fixed 1.12.14 → introduced 1.13.0-alpha.0 → fixed 1.15.4 → introduced 1.16.0-alpha.0 → fixed 1.16.2

Original source record · Cite this exact observation · Complete original publisher JSON