{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/dexidp/dex","cve_ids":["CVE-2024-23656"],"ecosystem":"Go","epss":0.00435,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-gr79-9v6v-gc9r","id":"tcs_01M5KG131XW022DAZ2JZ67J56W","modified_at":"2026-02-04T04:12:41.560459Z","published_at":"2024-06-28T15:28:53Z","references":["https://osv.dev/vulnerability/GO-2024-2476","https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r","https://nvd.nist.gov/vuln/detail/CVE-2024-23656","https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17","https://github.com/dexidp/dex/pull/2964","https://github.com/dexidp/dex/issues/2848","https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2476","url":"https://osv.dev/vulnerability/GO-2024-2476"}],"summary":"Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex"}