RHSA-2025:0536HighCVSS 8.2

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0

Published
January 21, 2025
Last Modified
September 18, 2026

🔗 CVE IDs covered (7)

CVE-2024-24783 →CVE-2024-28180 →CVE-2024-35255 →CVE-2024-45337 →CVE-2024-45338 →CVE-2023-45288 →CVE-2024-6104 →

📋 Description

CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2024-6104 — go-retryablehttp: url might write sensitive information to log file CVE-2024-24783 — golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm CVE-2024-28180 — jose-go: improper handling of highly compressed data CVE-2024-35255 — azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html

🎯 Affected products9

  • cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2e4eae54c75591d3dacd8165159397a63d6f695a1f733d12623652705ad40173_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4986a8ad37ed49652058e4acf30233649459f5e3c4b2bad9de5b9a4df6dfa531_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:49940e94193b06df5f5ff454aeb38a8b9a44e99b02d54600cb2442f81ff6dc25_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c1f40166786adbd77027d0dc210e8fcd0320e9f2d3b9a3df6f6ab27a46c8ade1_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:30d0113003152532d29a845550a78454a1f88099e90b475711ab74901560c67e_s390x as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:68286a86b7926a3ec88dc375a59a95716d8d3addea06ee7f88005fcd244b05a6_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1da35635852cc7e5d73bde8bbec209e5b55cfae7c421817a2b4bc7e454900c0_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.15
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:df96fa00709d2ff36b7b9d7977eb18aad4c3b3c93862e5babbfa76001353a3e8_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.15

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See 'https://docs.openshift.com/container- platform/latest/security/cert_manager_operator/index.html' for additional information. Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)