CVE Feed

    Dashboard / CVE / CVE-2024-23656

    CVE-2024-23656

    Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

    Published:Jan 25, 2024
    Last Modified:Jun 3, 2025
    EPS:Jan 25, 2024
    EPSS Score:0.00134
    CVSS Score:7.5

    Affected Products

    Vendor
    Linuxfoundation
    Product
    Dex

    Exploits

    https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9rhttps://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High