cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.
cert-manager v1.12.15 contains simple dependency bumps to address reported CVEs (CVE-2024-45337 and CVE-2024-45338).
We don't believe that cert-manager is actually vulnerable; this release is instead intended to satisfy vulnerability scanners.
It's important to note also that cert-manager v1.12 LTS has older base images which are no longer updated. These base images don't contain much, but they do contain time zone data which can get out of date.
To preserve original functionality, we don't intend to change the base images for cert-manager v1.12 LTS unless there's a very serious issue. As such, scanners may report issues with an out-of-date time zone database. If you require a newer base image, you should upgrade to a newer version of cert-manager.
What's Changed
- Bump golang.org/x/net and golang.org/x/crypto to address CVE-2024-45337 and CVE-2024-45338 by @wallrj in #7497
Full Changelog: v1.12.14...v1.12.15