CVE-2024-23656 - CVE House
Back to Database
Status published High CVE-2024-23656

Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Vulnerability Description

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23656

Credits & Attribution

No credits recorded in the NVD database.

References

More from dexidp

View All →
CVE-2022-39222
OAuth authorization code exposure in Dex
Critical 9.3
CVE-2020-26290
Critical security issues in XML encoding in Dex
Critical 9.3

Affected Vendor

Affected Software

dex
Vulnerable Versions:
= 2.37.0

Timeline

Official Publish: January 25th, 2024
Last Modified: June 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-326 CWE-757

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.