RHSA-2026:5645HighCVSS 7.5

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.1

Published
March 24, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (6)

CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →CVE-2025-47907 →CVE-2025-58183 →CVE-2025-61726 →

📋 Description

CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products9

  • cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:3a01605ba6dd883043f622596c54bfdfc938cdab48f4c32638e6cad807c57e9a_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:42f78dae41109753d076a75c14a9bc16096575cfdea102fdeda252665ff0381f_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4974faad72c7c67e6d55f7bf8c9c2d752af17a2f48ef63153fe226b080d36132_s390x as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:abcdf8c79fe663805d3bd5e43ac73b0472b5dab8c9dd80c90e1cf54ff161f41f_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6a2828505d9760b9d4f27d5eafa05db0d025b45787828bc5e125b7c75d1f329f_arm64 as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:9011ffee4064e0f466d6bc27c54f60ec2e1f041d1240548101d9ed9e0254df12_amd64 as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:a1bfde47d53ed34e899229870228ce35230fa216ade3e348befd9b77c2c7ceea_s390x as a component of cert-manager operator for Red Hat OpenShift 1.17
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:c73275043cc2caad071a88cb63f3745471fae11a953291b3dd93db4d752b1b13_ppc64le as a component of cert-manager operator for Red Hat OpenShift 1.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.

🔗 References (10)