cert-manager denial of service via crafted PEM input

Executive brief

cert-manager, a tool for managing TLS certificates in Kubernetes, is vulnerable to a denial-of-service attack. An attacker who can modify Kubernetes resources (like Secrets) can provide specially crafted certificate data that causes the system to consume excessive CPU power. This can slow down or crash the certificate management service, potentially preventing new certificates from being issued or renewed.

Technical details

A denial-of-service vulnerability exists in cert-manager due to its reliance on the Go standard library's pem.Decode() function, which exhibits inefficient parsing logic when handling certain invalid PEM data. An attacker with permissions to create or modify Kubernetes resources (such as Secrets or Certificates) can inject large, specially crafted PEM payloads. When cert-manager attempts to parse these inputs, it triggers a significant increase in CPU utilization, potentially leading to a controller-wide DoS. The impact is somewhat mitigated by the 1MiB size limit on Kubernetes Secrets, but multiple large resources can still be used to sustain the attack. Patches have been released in versions 1.12.14, 1.15.4, and 1.16.2.

Affected products

• cert-manager cert-manager < 1.12.14, >= 1.13.0-alpha.0, < 1.15.4, >= 1.16.0-alpha.0, < 1.16.2

Timeline

• 2024-11-20: advisory
• 2024-11-20: patched

References

• https://api.github.com/users/cookesan
• https://github.com/cookesan
• https://api.github.com/users/cookesan/gists%7B/gist_id%7D
• https://api.github.com/users/cookesan/repos
• https://avatars.githubusercontent.com/u/6601329?v=4
• https://api.github.com/users/cookesan/events%7B/privacy%7D