PT-2024-20005 · Dex · Dex

Tuminoid · Published 2024-01-25 · Updated 2024-06-28 · CVE-2024-23656

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dex version 2.37.0

Description Dex is an identity service that uses OpenID Connect to drive authentication for other apps. The issue arises from Dex serving HTTPS with insecure TLS 1.0 and TLS 1.1. The tlsConfig is ignored after the introduction of the "TLS cert reloader" in version 2.37.0, causing configured cipher suites to not be respected. This allows TLS 1.0 and TLS 1.1 connections to be decrypted by an attacker, potentially exposing traffic to Dex. The issue is fixed in Dex version 2.38.0.

Recommendations For Dex version 2.37.0, update to version 2.38.0 to resolve the issue. As a temporary workaround, consider disabling the use of TLS 1.0 and TLS 1.1 until a patch is available. Restrict access to the vulnerable cmd/dex/serve.go module to minimize the risk of exploitation. Avoid using insecure cipher suites in the affected API endpoints until the issue is resolved.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-757

CWE-326

Related Identifiers

CVE-2024-23656

GHSA-GR79-9V6V-GC9R

GO-2024-2476

Affected Products

Dex

References · 14

• 🔥 https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23656.json · Exploit
• https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17 · Patch
• https://github.com/dexidp/dex/pull/2964 · Patch
• https://osv.dev/vulnerability/GHSA-gr79-9v6v-gc9r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2476 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23656 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23656 · Security Note
• https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425 · Note
• https://github.com/dexidp/dex/issues/2848 · Note
• https://github.com/dexidp/dex · Note
• https://twitter.com/CVEnew/status/1750607592768918017 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1750640706845114649 · Twitter Post
• https://t.me/cvenotify/69435 · Telegram Post