CVE-2024-23656 json
Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
published 2024-01-25 2 y ago modified 2026-09-10 1 mo ago also GHSA-gr79-9v6v-gc9r , GO-2024-2476 , EUVD-2024-0360
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.
Patch / fix
- go github.com/dexidp/dex 0.0.0-20240125115555-5bbdb4420254, 2.38.0
- github.com/dexidp/dex@5bbdb44 commit
- github.com/dexidp/dex#2964 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/dexidp/dex | >=2.37.0, <2.38.0 <0.0.0-20240125115555-5bbdb4420254 all versions |
2.38.0 0.0.0-20240125115555-5bbdb4420254 |
Affected products
- dexidp dex
Classification
References
-
github.com
/dexidp/dex/pull/2964
web, issue-tracking, patch
-
github.com
/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17
web, patch
-
github.com
/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r
web, exploit, advisory
-
github.com
/dexidp/dex/issues/2848
web, issue-tracking, report
-
github.com
/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-23656
advisory
-
github.com
/dexidp/dex
package
Sources
- CVE List CVE-2024-23656
- GitHub Advisory GHSA-gr79-9v6v-gc9r
- NVD CVE-2024-23656
- OSV GO-2024-2476
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.