CVE-2024-23656

    Dashboard / Vulnerabilities / CVE-2024-23656

    CVE-2024-23656

    Published: 25 Jan 2024Last Modified: 12 Aug 2026

    Summary: Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

    Details: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

    References: https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23656.json, https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r, https://nvd.nist.gov/vuln/detail/CVE-2024-23656, https://github.com/dexidp/dex/issues/2848, https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17, https://github.com/dexidp/dex/pull/2964

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 08bb7fb98b164ab078be17ecda4077b2d21c9bb3
    Fixed -5bbdb4420254ba73b9c4df4775fe7bdacf233b17

    Affected versions

    2.37.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-23656 | CVE-DB