x/vulndb: potential Go vuln in github.com/dexidp/dex: CVE-2024-23656

[GoVulnBot]

CVE-2024-23656 references github.com/dexidp/dex, which may be a Go module.

Description:
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-23656
• JSON: https://github.com/CVEProject/cvelist/tree/b78475792c79b641f11b9cd02837f971e9f8fc62/2024/23xxx/CVE-2024-23656.json
• advisory: GHSA-gr79-9v6v-gc9r
• report: Support configuration of TLS min and max versions dexidp/dex#2848
• fix: tls cert reloader dexidp/dex#2964
• fix: dexidp/dex@5bbdb44
• web: https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425
• Imported by: https://pkg.go.dev/github.com/dexidp/dex?tab=importedby

Cross references:

• Module github.com/dexidp/dex appears in issue x/vulndb: potential Go vuln in github.com/dexidp/dex: GHSA-vh7g-p26c-j2cw #1035 EFFECTIVELY_PRIVATE
• Module github.com/dexidp/dex appears in issue x/vulndb: potential Go vuln in github.com/dexidp/dex: GHSA-2x32-jm95-2cpx #1302 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/dexidp/dex
      vulnerable_at: 0.6.1
      packages:
        - package: dex
cves:
    - CVE-2024-23656
references:
    - advisory: https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r
    - report: https://github.com/dexidp/dex/issues/2848
    - fix: https://github.com/dexidp/dex/pull/2964
    - fix: https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17
    - web: https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425

[gopherbot]

Change https://go.dev/cl/560816 mentions this issue: data/excluded: batch add 14 excluded reports

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports