CVE-2024-23656

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Inadequate Encryption Strength pada linuxfoundation dex. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

Rincian

Terbit di NVD

25 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-326: Inadequate Encryption Strength
CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17 patch
• https://github.com/dexidp/dex/pull/2964 issue tracking · patch
• https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r exploit
• https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425 product
• https://github.com/dexidp/dex/issues/2848 issue tracking