This patch release contains fixes for the following security vulnerabilities in the cert-manager-controller:
GO-2023-2334: Decryption of malicious PBES2 JWE objects can consume unbounded system resources.
If you use ArtifactHub Security report or trivy, this patch will also silence the following warning about a vulnerability in code which is imported but not used by the cert-manager-controller:
CVE-2023-47108: DoS vulnerability in otelgrpc due to unbound cardinality metrics.
An ongoing security audit of cert-manager suggested some changes to the webhook code to mitigate DoS attacks, and these are included in this patch release.
Changes
Bug or Regression
The webhook server now returns HTTP error 413 (Content Too Large) for requests with body size >= 3MiB. This is to mitigate DoS attacks that attempt to crash the webhook process by sending large requests that exceed the available memory. (#6507, @inteon)
The webhook server now returns HTTP error 400 (Bad Request) if the request contains an empty body. (#6507, @inteon)
The webhook server now returns HTTP error 500 (Internal Server Error) rather than crashing, if the code panics while handling a request. (#6507, @inteon)
Mitigate potential "Slowloris" attacks by setting ReadHeaderTimeout in all http.Server instances. (#6538, @wallrj)
