Описание
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.
Ссылки
- Product
- Patch
- Issue Tracking
- Issue TrackingPatch
- Exploit
- Product
- Patch
- Issue Tracking
- Issue TrackingPatch
- Exploit
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:linuxfoundation:dex:2.37.0:*:*:*:*:*:*:*
EPSS
Процентиль: 40%
0.00182
Низкий
7.5 High
CVSS3
Дефекты
CWE-326
CWE-326
Связанные уязвимости
CVSS3: 7.5
debian
около 2 лет назад
Dex is an identity service that uses OpenID Connect to drive authentic ...
CVSS3: 7.5
github
около 2 лет назад
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers
EPSS
Процентиль: 40%
0.00182
Низкий
7.5 High
CVSS3
Дефекты
CWE-326
CWE-326