dex

dex - 一个联邦式 OpenID Connect 身份提供者 Dex 是一种身份服务，使用 OpenID Connect 为其他应用驱动身份认证。 Dex 通过连接器.充当通往其他身份提供者的门户。这使 dex 可以将身份认证委托给 LDAP 服务器、SAML 提供商，或 GitHub、Google 和 Active Directory 等成熟的身份提供者。客户端只需编写一次与 dex 通信的身份认证逻辑，随后由 dex 处理特定后端的协议。 ID Tokens ID Token 是 OpenID Connect 引入的一种 OAuth2 扩展，也是 dex 的主要功能。ID Tok...

[SECURITY] [DSA 6480-1] keystone security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6480-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 01, 2026 https://www.debian.org/security/faq -...

GHSA-855V-HQ7W-JMJW Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Debian dsa-6331 : keystone - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6331 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6331-1 [email protected]...

Debian dla-4611 : keystone - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4611 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4611-1 [email protected]...

Cloud Foundry cf-deployment和Cloud Foundry UUA 安全漏洞

Cloud Foundry cf-deployment and Cloud Foundry UUA are both products of the American Cloud Foundry Foundation. Cloud Foundry cf-deployment is a Cloud Foundry deployment tool. Cloud Foundry UUA is an identity authentication and authorization management service. There are security vulnerabilities in...

EUVD-2026-22962

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to...

MiracleLinux 7 : ipa-4.6.5-11.4.0.1.el7.AXS7 (AXSA:2020-4468:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-4468:01 advisory. ipa: Denial of service in IPA server due to wrong use of berscanf CVE-2019-14867 ipa: Batch API logging user passwords to /var/log/httpd/errorlog...

PT-2025-45125

Name of the Vulnerable Software and Affected Versions Cisco ISE and Cisco ISE-PIC affected versions not specified Description The web-based management interface of Cisco ISE and Cisco ISE-PIC contains weaknesses that could allow an authenticated, remote attacker to perform a reflected Cross-Site...

EUVD-2016-0034

Malware in sbrugna...

EUVD-2018-0083

Malware in sbrugna...

EUVD-2016-2501

Malware in sbrugna...

EUVD-2024-0360

Malicious code in bioql PyPI...

CVE-2024-23656

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CloudFoundry UAA 安全漏洞

CloudFoundry UAA is a multi-tenant identity management service from the CloudFoundry Foundation. A security vulnerability exists in CloudFoundry UAA that stems from an inability to properly validate session information between regions. An attacker exploiting this vulnerability could reuse its...

RHEL 6 : openstack-keystone (RHSA-2014:0994)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0994 advisory. The OpenStack Identity service keystone authenticates and authorizes OpenStack users by keeping track of users and their permitted activitie...

CVE-2024-23656

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656

Dex 2.37.0 serves HTTPS with TLS 1.0/1.1 and non-respected cipher suites because tlsConfig is ignored after the TLS cert reloader; minimum TLS version hardening is ineffective. This can allow eavesdropping on TLS 1.0/1.1 traffic. The issue is fixed in Dex 2.38.0.

CVE-2024-23656 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...