{"action":"Upgrade github.com/dexidp/dex to 0.0.0-20240125115555-5bbdb4420254 or later.","affected":[{"fixed":"2.38.0","introduced":"2.37.0"},{"introduced":"0"}],"component":"github.com/dexidp/dex","cve_ids":["CVE-2024-23656"],"ecosystem":"Go","epss":0.00435,"exploited":false,"fixed_versions":["2.38.0","0.0.0-20240125115555-5bbdb4420254"],"ghsa_id":"GHSA-gr79-9v6v-gc9r","id":"tcs_01M5KFBAYWC4TANTTFTXGAVC6J","modified_at":"2026-09-10T03:50:00.231186716Z","published_at":"2024-01-26T01:57:31Z","references":["https://osv.dev/vulnerability/GHSA-gr79-9v6v-gc9r","https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r","https://nvd.nist.gov/vuln/detail/CVE-2024-23656","https://github.com/dexidp/dex/issues/2848","https://github.com/dexidp/dex/pull/2964","https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17","https://github.com/dexidp/dex","https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gr79-9v6v-gc9r","url":"https://osv.dev/vulnerability/GHSA-gr79-9v6v-gc9r"}],"summary":"Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers"}