id: GO-2024-2476
modules:
    - module: github.com/dexidp/dex
      non_go_versions:
        - introduced: 2.37.0
        - fixed: 2.38.0
      vulnerable_at: 0.6.1
summary: |-
    Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure
    ciphers in github.com/dexidp/dex
cves:
    - CVE-2024-23656
ghsas:
    - GHSA-gr79-9v6v-gc9r
references:
    - advisory: https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-23656
    - fix: https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17
    - fix: https://github.com/dexidp/dex/pull/2964
    - report: https://github.com/dexidp/dex/issues/2848
    - web: https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425
source:
    id: GHSA-gr79-9v6v-gc9r
    created: 2024-06-14T11:36:28.742125-04:00
review_status: UNREVIEWED
unexcluded: EFFECTIVELY_PRIVATE