Update module github.com/cert-manager/cert-manager to v1.12.14 [SECURITY] #25
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.8.0->v1.12.14Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
GHSA-r4pg-vg54-wxx4
Impact
cert-manager packages which call the standard library
pem.Decode()function can take a long time to process specially crafted invalid PEM data.If an attacker is able to modify PEM data which cert-manager reads (e.g. in a Secret resource), they may be able to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for cert-manager in the cluster.
Secrets are limited in size to 1MiB, which reduces the impact of this issue; it was discovered through an ~856kB fuzz test input which causes
pem.Decodeto take roughly 750ms to reject the input on an M2 Max Macbook Pro. By way of comparison, a valid PEM-encoded 4096-bit RSA key takes roughly 70µs to parse on the same machine.Given the required size of PEM data needed to present a realistic DoS vector, an attacker would need to create or insert many different large sized resources in the cluster, and so the best secondary defense is to ensure that sensible limits are placed via RBAC.
This issue affects all versions of cert-manager to have been released since at least v0.1.0 (since
pem.Decodeis core functionality for cert-manager). All supported releases are patched.Patches
The fixed versions are v1.16.2, v1.15.4 and v1.12.14.
Workarounds
Ensure that RBAC is scoped correctly in your cluster. If a user is able to modify resources containing PEM data to be able to exploit this, it's like that those permissions are a bigger security threat than this issue - especially for Secret resources.
References
Release Notes
cert-manager/cert-manager (github.com/cert-manager/cert-manager)
v1.12.14Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
This patch release of cert-manager 1.12 makes several changes to how PEM input is validated, adding maximum sizes appropriate to the type of PEM data which is being parsed.
This is to prevent an unacceptable slow-down in parsing specially crafted PEM data. The issue was found by Google's OSS-Fuzz project.
The issue is low severity; to exploit the PEM issue would require privileged access which would likely allow Denial-of-Service through other methods.
Note also that since most PEM data parsed by cert-manager comes from
ConfigMaporSecretresources which have a max size limit of approximately 1MB, it's difficult to force cert-manager to parse large amounts of PEM data.Further information is available in GHSA-r4pg-vg54-wxx4
This patch release also fix an issue reported by Trivy, although that issue is low severity and is not expected to be relevant to cert-manager.
Bug Fixes
github.com/golang-jwt/jwt/v4(#7407, @SgtCoDFish)v1.12.13Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.12.12
This patch release fixes the following vulnerabilities:
CVE-2024-6104,CVE-2024-24791,CVE-2024-25620,CVE-2024-26147, andCVE-2024-41110.Bugfixes
go-retryablehttpdependency to fixCVE-2024-6104(#7128, @SgtCoDFish)CVE-2024-25620andCVE-2024-26147and Docker dependency to resolveCVE-2024-41110(#7214, @ThatsMrTalbot)1.21.13to resolveCVE-2024-24791(#7216, @ThatsMrTalbot)v1.12.12Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.12.11
Bugfixes
Other (Cleanup or Flake)
v1.12.11Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
📜 Changes since v1.12.10
Other (Cleanup or Flake)
v1.12.10Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.10fixes a bug in the DigitalOcean DNS-01 provider which could cause incorrect DNS records to be deleted when using a domain with a CNAME. Special thanks to @BobyMCbobs for reporting this issue and testing the fix!It also patches CVE-2023-45288.
ACME Issuer (Let's Encrypt): wrong certificate chain may be used if preferredChain is configured: see release docs for more info and mitigations
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see https://github.com/cert-manager/cert-manager/pull/6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
Changes
Bug or Regression
v1.12.9Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
ACME Issuer (Let's Encrypt): wrong certificate chain may be used if preferredChain is configured: see release docs for more info and mitigations
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see https://github.com/cert-manager/cert-manager/pull/6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.12.0 release notes
📜 Changes since v1.12.8
Bug or Regression
cert-manager.io/allow-direct-injectionin annotations (#6811, @jetstack-bot)Other (Cleanup or Flake)
v1.12.8Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
ACME Issuer (Let's Encrypt): wrong certificate chain may be used if preferredChain is configured: see release docs for more info and mitigations
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see https://github.com/cert-manager/cert-manager/pull/6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
ℹ️ Documentation
Release notes
Upgrade notes
Installation instructions
🔧 Breaking changes
See Breaking changes in v1.12.0 release notes
📜 Changes since v1.12.7
Bug or Regression
Other (Cleanup or Flake)
github.com/containerd/[email protected](#6689, @wallrj)v1.12.7Compare Source
This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2382: Denial of service via chunk extensions innet/httpIf you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108: DoS vulnerability inotelgrpcdue to unbound cardinality metrics.An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks,
and these are included in this patch release.
Known bugs
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see https://github.com/cert-manager/cert-manager/pull/6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
Changes
Feature
1.20.12(#6543, @wallrj).Bug or Regression
>= 3MiB. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory (#6506, @inteon).ReadHeaderTimeoutin allhttp.Serverinstances (#6539, @wallrj).otelanddockerto fix:CVE-2023-47108andGHSA-jq35-85cj-fj4p(#6513, @inteon).Dependencies
Added
cloud.google.com/go/dataproc/v2:v2.0.1Changed
cloud.google.com/go/aiplatform:v1.45.0 → v1.48.0cloud.google.com/go/analytics:v0.21.2 → v0.21.3cloud.google.com/go/baremetalsolution:v0.5.0 → v1.1.1cloud.google.com/go/batch:v0.7.0 → v1.3.1cloud.google.com/go/beyondcorp:v0.6.1 → v1.0.0cloud.google.com/go/bigquery:v1.52.0 → v1.53.0cloud.google.com/go/cloudbuild:v1.10.1 → v1.13.0cloud.google.com/go/cloudtasks:v1.11.1 → v1.12.1cloud.google.com/go/compute:v1.21.0 → v1.23.0cloud.google.com/go/contactcenterinsights:v1.9.1 → v1.10.0cloud.google.com/go/container:v1.22.1 → v1.24.0cloud.google.com/go/datacatalog:v1.14.1 → v1.16.0cloud.google.com/go/dataplex:v1.8.1 → v1.9.0cloud.google.com/go/datastore:v1.12.1 → v1.13.0cloud.google.com/go/datastream:v1.9.1 → v1.10.0cloud.google.com/go/deploy:v1.11.0 → v1.13.0cloud.google.com/go/dialogflow:v1.38.0 → v1.40.0cloud.google.com/go/documentai:v1.20.0 → v1.22.0cloud.google.com/go/eventarc:v1.12.1 → v1.13.0cloud.google.com/go/firestore:v1.11.0 → v1.12.0cloud.google.com/go/gkebackup:v0.4.0 → v1.3.0cloud.google.com/go/gkemulticloud:v0.6.1 → v1.0.0cloud.google.com/go/kms:v1.12.1 → v1.15.0cloud.google.com/go/maps:v0.7.0 → v1.4.0cloud.google.com/go/metastore:v1.11.1 → v1.12.0cloud.google.com/go/policytroubleshooter:v1.7.1 → v1.8.0cloud.google.com/go/pubsub:v1.32.0 → v1.33.0cloud.google.com/go/run:v0.9.0 → v1.2.0cloud.google.com/go/servicedirectory:v1.10.1 → v1.11.0cloud.google.com/go/speech:v1.17.1 → v1.19.0cloud.google.com/go/translate:v1.8.1 → v1.8.2cloud.google.com/go/video:v1.17.1 → v1.19.0cloud.google.com/go/vmwareengine:v0.4.1 → v1.0.0cloud.google.com/go:v0.110.4 → v0.110.7github.com/felixge/httpsnoop:v1.0.3 → v1.0.4github.com/go-logr/logr:v1.2.4 → v1.3.0github.com/golang/glog:v1.1.0 → v1.1.2github.com/google/go-cmp:v0.5.9 → v0.6.0github.com/google/uuid:v1.3.0 → v1.3.1go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc:v0.45.0 → v0.46.0go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp:v0.44.0 → v0.46.0go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc:v1.19.0 → v1.20.0go.opentelemetry.io/otel/exporters/otlp/otlptrace:v1.19.0 → v1.20.0go.opentelemetry.io/otel/metric:v1.19.0 → v1.20.0go.opentelemetry.io/otel/sdk:v1.19.0 → v1.20.0go.opentelemetry.io/otel/trace:v1.19.0 → v1.20.0go.opentelemetry.io/otel:v1.19.0 → v1.20.0go.uber.org/goleak:v1.2.1 → v1.3.0golang.org/x/oauth2:v0.10.0 → v0.11.0golang.org/x/sys:v0.13.0 → v0.14.0google.golang.org/genproto/googleapis/api:782d3b1 → b8732ecgoogle.golang.org/genproto/googleapis/rpc:782d3b1 → b8732ecgoogle.golang.org/genproto:782d3b1 → b8732ecgoogle.golang.org/grpc:v1.58.3 → v1.59.0Removed
cloud.google.com/go/dataproc:v1.12.0v1.12.6Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.6 fixes some CVE alerts and a Venafi issuer bug.
Known bugs
If you misconfigure two Certificate resources to have the same target Secret resource, cert-manager will generate a MANY CertificateRequests, possibly causing high CPU usage and/ or high costs due to the large number of certificates issued (see https://github.com/cert-manager/cert-manager/pull/6406).
This problem was resolved in v1.13.2 and other later versions, but the fix cannot be easily backported to v1.12.x. We recommend using v1.12.x with caution (avoid misconfigured Certificate resources) or upgrading to a newer version.
Changes since v1.12.5
Bug or Regression
WebSDK CertRequest Module Requested CertificateorThis certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry.. (#6401, @maelvls)Other (Cleanup or Flake)
v1.12.5Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.5 contains a backport for a name collision bug that was found in v1.13.0
Changes since v1.12.4
Bug or Regression
Other (Cleanup or Flake)
v1.12.4Compare Source
v1.12.4 contains an important security fix that addresses CVE-2023-29409.
Changes since v1.12.3
net.IP.String()function would have printed that address. (#6297, @SgtCoDFish)crypto/tlslibrary. (#6318, @maelvls)v1.12.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.3 contains a bug fix for the cainjector which addresses a memory leak!
Changes since v1.12.2
Bugfixes
v1.12.2Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.2 is a bugfix release, but includes a known issue and you should prefer the latest patch release!
Known issues
Changes since v1.12.1
Bugfixes
cmctl check api --wait 0exited without output; we now make sure we perform the API check at least once (#6116, @jetstack-bot)v1.12.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.12.1 release contains a couple dependency bumps and changes to ACME external webhook library.
Known issues
cmctlAPI check is broken in v1.12.0 and v1.12.1. We suggest that you do not upgradecmctlto this version. The fix was released in v1.12.2 (which has an additional issue, see below). See #6116 for context.Changes since v1.12.0
Other (Cleanup or Flake)
Uncategorized
v0.27.2. (#6077, @lucacome)v0.15.0(#6098, @lucacome)v1.12.0Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager v1.12 brings support for JSON logging, a lower memory footprint, support for ephemeral service account tokens with Vault, improved dependency management and support for the ingressClassName field.
The full release notes are available at https://cert-manager.io/docs/release-notes/release-notes-1.12.
Known issues
cmctlAPI check is broken in v1.12.0 and v1.12.1. We suggest that you do not upgradecmctlto this version. The fix was released in v1.12.2 (which has an additional issue, see below). See #6116 for context.Community
Thanks again to all open-source contributors with commits in this release, including:
Thanks also to the following cert-manager maintainers for their contributions during this release:
Equally thanks to everyone who provided feedback, helped users and raised issues on Github and Slack, joined our meetings and talked to us at Kubecon!
Special thanks to @erikgb for continuously great input and feedback and to @lucacome for always ensuring that our kube deps are up to date!
Thanks also to the CNCF, which provides resources and support, and to the AWS open source team for being good community members and for their maintenance of the PrivateCA Issuer.
In addition, massive thanks to Jetstack (by Venafi) for contributing developer time and resources towards the continued maintenance of cert-manager projects.
Changes by Kind
Feature
--concurrent-workersflag that lets you control the number of concurrent workers for each of our controllers. (#5936, @inteon)acme.solvers.http01.ingress.podTemplate.spec.imagePullSecretsfield to issuer spec to allow to specify image pull secrets for the ACME HTTP01 solver pod. (#5801, @malovme)--watch-certsflag was renamed to--enable-certificates-data-source. (#5766, @irbekrm)--dns01-recursive-nameservers,--enable-certificate-owner-ref, and--dns01-recursive-nameservers-onlythrough Helm values. (#5614, @jkroepke)ingressClassName. The credit goes to @dsonck92 for implementing the initial PR. (#5849, @maelvls)serviceAccountReffield, cert-manager generates a short-lived token associated to the service account to authenticate to Vault. Along with this new feature, we have added validation logic in the webhook in order to check thevault.authfield when creating an Issuer or ClusterIssuer. Previously, it was possible to create an Issuer or ClusterIssuer with an invalid value forvault.auth. (#5502, @maelvls)/livezendpoint and a default liveness probe, which fails if leader election has been lost and for some reason the process has not exited. The liveness probe is disabled by default. (#5962, @wallrj)--v=5flag) (#5975, @tobotg)Design
This is not necessarily a breaking change as due to a race condition this may already have been the case. (#5887, @irbekrm)
Documentation
values.yamlare now working (#5999, @SgtCoDFish)Bug or Regression
cmctl x install. (#5720, @irbekrm)--acme-http01-solver-imagegiven to the variableacmesolver.extraArgsnow has precedence over the variableacmesolver.image. (#5693, @SgtCoDFish)jksandpkcs12fields on a Certificate resource with a CA issuer that doesn't set theca.crtin the Secret resource, cert-manager no longer loop trying to copyca.crtintotruststore.jksortruststore.p12. (#5972, @vinzent)literalSubjectfield on a Certificate resource, the IPs, URIs, DNS names, and email addresses segments are now properly compared. (#5747, @inteon)Other (Cleanup or Flake)
make go-workspacetarget for generating a go.work file for local development (#5935, @SgtCoDFish)**BREAKING:*- users who are relying on cainjector to work when
certificates.cert-manager.ioCRD is not installed in the cluster, now need to pass--watch-certificates=falseflag to cainjector else it will not start.Users who only use cainjector as cert-manager's internal component and have a large number of
Certificateresources in cluster can pass--watch-certificates=falseto avoid cainjector from cachingCertificateresources and save some memory. (#5746, @irbekrm)automountServiceAccountTokenturned off. (#5754, @wallrj)SecretsFilteredCachingfeature flag. The filtering mechanism might, in some cases, slightly slow down issuance or cause additional requests to kube-apiserver because unlabelled Secret resources that cert-manager controller needs will now be retrieved from kube-apiserver instead of being cached locally. To prevent this from happening, users can label all issuer Secret resources with thecontroller.cert-manager.io/fao: truelabel. (#5824, @irbekrm)POTENTIALLY BREAKING: this PR slightly changes how the name of the Challenge resources are calculated. To avoid duplicate issuances due to the Challenge resource being recreated, ensure that there is no in-progress ACME certificate issuance when you upgrade to this version of cert-manager. (#5901, @irbekrm)
v0.26.2. (#5820, @lucacome)v0.26.3. (#5907, @lucacome)v0.27.1. (#5961, @lucacome)certificate.spec.secretNameis a validSecretname (#5967, @avi-08)certificate.spec.secretNameSecrets will now be labelled withcontroller.cert-manager.io/faolabel (#5660, @irbekrm)Uncategorized
v1.11.5Compare Source
v1.11.5 contains an important security fix that addresses CVE-2023-29409.
Changes since v1.11.4
crypto/tlslibrary. (#6317, @maelvls)v1.11.4Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager v1.11.4 contains some version bumps to address reported CVEs (although we don't expect that cert-manager was actually vulnerable to anything!)
Changes by Kind
Other (Cleanup or Flake)
Dependencies
Changed
v1.11.3Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
v1.11.3 mostly contains ACME library changes. API Priority and Fairness feature is now disabled in the external webhook's extension apiserver.
Changes by Kind
Other (Cleanup or Flake)
v1.11.2Compare Source
Changelog since v1.11.1
Changes by Kind
Bug or Regression
Other (Cleanup or Flake)
Bump the distroless base images (#5930, @maelvls)
Bumps Docker libraries to fix vulnerability scan alert for CVE-2023-28840, CVE-2023-28841, CVE-2023-28842 (#6037, @irbekrm)
Cert-manager was not actually affected by these CVEs which are all to do with Docker daemon's overlay network.
Bumps Kube libraries v0.26.0 -> v0.26.4 (#6038, @irbekrm)
This might help with running cert-manager v1.11 on Kubernetes v1.27, see #6038
v1.11.1Compare Source
cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
In v1.11.1, we updated the base images used for cert-manager containers. In addition, the users of the Venafi issuer will see less certificates repeatedly failing.
If you are a user of Venafi TPP and have been having issues with the error message
This certificate cannot be processed while it is in an error state. Fix any errors, and then click Retry, please use this version.Changes since v1.11.0
Bug or Regression
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.