A maintenance release with a security fix in the cert-manager controller, along with routine bug fixes and a Go toolchain dependency update. The security fix addresses a DNS response handling issue that could cause controller denial of service.
Check if affected (1)
securitymedium
cert-manager controllerDNS response panic fix, GHSA-gx3x-vq4p-mhhvApplicability is not stated in the release notes.
This release fixes a potential panic in the
cert-manager controllerwhen a cached DNS response arrives in an unexpected order. The issue is tracked as GHSA-gx3x-vq4p-mhhv and could cause denial of service when an attacker modifies DNS responses or controls the DNS server.