GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: frp, cloudflared, temporal-fips, rekor, bank-vaults, guac, tekton-chains, kube-rbac-proxy-fips, timestamp-authority, vexctl, kubernetes-dashboard-fips, slsa-verifier, grpc-health-probe, step, ko-fips, bank-vaults-fips, cosign-fips, goreleaser, falcoctl,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: syft, temporal-fips, kyverno-policy-reporter-kyverno-plugin, logstash-exporter-fips, kubeflow-fips, gh, crossplane-provider-aws-eks, grafana-operator-fips, vexctl, nats, prometheus-elasticsearch-exporter-fips, conftest-fips, capslock, cfssl, azure-aad-pod-identity-mi...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: syft, temporal-fips, kyverno-policy-reporter-kyverno-plugin, logstash-exporter-fips, kubeflow-fips, gh, crossplane-provider-aws-eks, grafana-operator-fips, vexctl, nats, prometheus-elasticsearch-exporter-fips, conftest-fips, capslock, cfssl, azure-aad-pod-identity-mi...

GHSA-GR79-9V6V-GC9R vulnerabilities

Vulnerabilities for packages: dex...

Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating...

GHSA-GR79-9V6V-GC9R Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating...

GHSA-GR79-9V6V-GC9R vulnerabilities

Vulnerabilities for packages: dex...

CVE-2024-23656 vulnerabilities

Vulnerabilities for packages: dex...

CVE-2024-23656 vulnerabilities

Vulnerabilities for packages: dex...

CVE-2024-23656

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

Authentication flaw

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656 Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers

Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. cmd/dex/serve.go line 425 seemingly sets TLS 1.2 as minimum version, but the whole tlsConfig is ignored after TLS cert reloader was introduced in...

CVE-2024-23656

Dex 2.37.0 serves HTTPS with TLS 1.0/1.1 and non-respected cipher suites because tlsConfig is ignored after the TLS cert reloader; minimum TLS version hardening is ineffective. This can allow eavesdropping on TLS 1.0/1.1 traffic. The issue is fixed in Dex 2.38.0.

dex Security Vulnerabilities

dex is an identity service that uses OpenID Connect to drive authentication for other applications. A security vulnerability exists in versions of dex prior to 2.38.0 that stems from the use of insecure TLS 1.0 and TLS 1.1 to provide HTTPS, which can be exploited by an attacker to decrypt TLS 1.0...

CVE-2024-20802

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

CVE-2024-20802

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

Improper access control

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

CVE-2024-20802

Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification in a multi-user environment...

CVE-2024-20802

Samsung DeX is affected by CVE-2024-20802 due to improper access control that allows the device owner to access other users’ notifications in a multi-user environment. Affected software: Samsung DeX prior to SMR Jan-2024 Release 1. Root cause: improper access control in the notification handling ...