Read the docs
TI-2024-15675 Aliases CVE-2024-23656GHSA-gr79-9v6v-gc9r

Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Priority HIGH 72CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-326.

Summary

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00435 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/dexidp/dex (Go): 2.38.0, 0.0.0-20240125115555-5bbdb4420254

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagedex= 2.37.0—No fix listedCNA
—github.com/dexidp/dex (Go)2.37.0 to before 2.38.02.38.0Patch availableGHSA-gr79-9v6v-gc9r
—github.com/dexidp/dex (Go)before 0.0.0-20240125115555-5bbdb44202540.0.0-20240125115555-5bbdb4420254Patch availableGHSA-gr79-9v6v-gc9r
  • dex Vendorbackstage Affected = 2.37.0 Fixed in — No fix listed CNA
  • github.com/dexidp/dex (Go) Vendor— Affected 2.37.0 to before 2.38.0 Fixed in 2.38.0 Patch available GHSA-gr79-9v6v-gc9r
  • github.com/dexidp/dex (Go) Vendor— Affected before 0.0.0-20240125115555-5bbdb4420254 Fixed in 0.0.0-20240125115555-5bbdb4420254 Patch available GHSA-gr79-9v6v-gc9r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:dex:2.37.0:*:*:*:*:*:*:*2.37.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:dex:2.37.0:*:*:*:*:*:*:* Versions 2.37.0 Vulnerable ·backstage

Remediation

  • Fix · GHSA-gr79-9v6v-gc9r github.com/dexidp/dex (Go) Fixed in 2.38.0 Advisory →
  • Fix · GHSA-gr79-9v6v-gc9r github.com/dexidp/dex (Go) Fixed in 0.0.0-20240125115555-5bbdb4420254 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23656
  2. 2026-10-03 Alias added: GHSA-gr79-9v6v-gc9r

References

Exploit 1

Patch 2

Advisory 1

Other 3

  • TI-2022-18601 OAuth authorization code exposure in Dex CVSS 3.1CRITICAL 9.3
  • TI-2020-16917 Authentication bypass by spoofing in dexidp/dex CVSS 3.1CRITICAL 9.8
  • TI-2020-16111 Critical security issues in XML encoding in Dex CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences