Dex: Token-exchange endpoint is missing AllowedConnectors enforcement in github.com/dexidp/dex

概要

参考情報

• dexidp/dex security advisory · ADVISORY
• dexidp/dex commit 204dbb2 · FIX

github.com/dexidp/dex のその他の脆弱性

• GHSA-7qjx-gp9h-65qj高 8.7Dex: Token-exchange endpoint is missing AllowedConnectors enforcement
• CVE-2024-23656高 7.5Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 an…
• CVE-2022-39222中 6.5Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extens…
• CVE-2020-26290緊急 9.6Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impa…