CVE-2024-12401: Red Hat Cert-Manager Operator For Red Hat Openshift

Medium severity, CVSS 4.4. EPSS: 0.7% chance of exploitation in the next 30 days.

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster.

Affected products

• Red Hat Cert-Manager Operator For Red Hat Openshift
• Red Hat Cryostat 3
• Red Hat Multicluster Engine For Kubernetes
• Red Hat Openshift Serverless
• Red Hat Red Hat Connectivity Link 1
• Red Hat Red Hat Openshift Container Platform 4
• Red Hat Red Hat Openshift Data Foundation 4
• Red Hat Red Hat Openshift Gitops

Published 2024-12-12. Last modified 2026-06-26.