CVE-2024-23656: dexidp dex Inadequate Encryption Strength

Vulnerability summary

CVE-2024-23656 is a high (CVSS 7.5) Inadequate Encryption Strength vulnerability in dexidp dex. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-01-2024
   PublishedVulnerability first disclosed.
2. 03-06-2025
   Last modifiedVulnerability information updated.

Description

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.

• CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
• CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.