Linuxfoundation Dex vulnerabilities

4 CVEs affecting Linuxfoundation Dex, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-23656, published 2024-01-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-27847, published 2021-05-28. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest…
CVE-2022-39222, published 2022-10-06. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex…
CVE-2020-26290, published 2020-12-28. Critical severity, CVSS 9.6. EPSS: 1% chance of exploitation in the next 30 days. Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The…
CVE-2024-23656, published 2024-01-25. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS…