dex-v2.40.0_linux_amd64

digest	sha256:59d8b5540fcf4e876b70fb5438321c594b84a5b4a255540e9bb41834fd797770
vulnerabilities
size	34 MB
packages	225

stdlib 1.22.3 (golang) pkg:golang/stdlib@1.22.3 # Dockerfile (76:76) COPY --from=builder /go/bin/dex /usr/local/bin/dex Affected range >=1.22.0-0 <1.22.4 Fixed version 1.22.4 EPSS Score 0.06% EPSS Percentile 28th percentile Description The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. Affected range <1.22.7 Fixed version 1.22.7 EPSS Score 0.04% EPSS Percentile 17th percentile Description Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. Affected range <1.22.7 Fixed version 1.22.7 EPSS Score 0.04% EPSS Percentile 17th percentile Description Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. Affected range >=1.22.0-0 <1.22.5 Fixed version 1.22.5 EPSS Score 0.04% EPSS Percentile 17th percentile Description The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail. Affected range <1.22.7 Fixed version 1.22.7 EPSS Score 0.19% EPSS Percentile 56th percentile Description Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. Affected range >=1.22.0-0 <1.22.4 Fixed version 1.22.4 EPSS Score 0.04% EPSS Percentile 11th percentile Description The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. Affected range <1.22.7 Fixed version 1.22.7 EPSS Score 0.04% EPSS Percentile 17th percentile Description Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

openssl 3.3.0-r2 (apk) pkg:apk/alpine/openssl@3.3.0-r2?os_name=alpine&os_version=3.20 # Dockerfile (38:57) FROM alpine:3.20.0@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd AS stager RUN mkdir -p /var/dex RUN mkdir -p /etc/dex COPY config.docker.yaml /etc/dex/ FROM alpine:3.20.0@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd AS gomplate ARG TARGETOS ARG TARGETARCH ARG TARGETVARIANT ENV GOMPLATE_VERSION=v3.11.8 RUN wget -O /usr/local/bin/gomplate \ "https://github.com/hairyhenderson/gomplate/releases/download/${GOMPLATE_VERSION}/gomplate_${TARGETOS:-linux}-${TARGETARCH:-amd64}${TARGETVARIANT}" \ && chmod +x /usr/local/bin/gomplate # For Dependabot to detect base image versions FROM alpine:3.20.0@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd AS alpine Affected range <3.3.1-r1 Fixed version 3.3.1-r1 EPSS Score 0.04% EPSS Percentile 14th percentile Description Affected range <3.3.2-r0 Fixed version 3.3.2-r0 EPSS Score 0.04% EPSS Percentile 17th percentile Description Affected range <3.3.2-r1 Fixed version 3.3.2-r1 EPSS Score 0.04% EPSS Percentile 11th percentile Description Affected range <3.3.0-r3 Fixed version 3.3.0-r3 Description

github.com/dexidp/dex 2.40.0 (golang) pkg:golang/github.com/dexidp/dex@2.40.0 # Dockerfile (76:76) COPY --from=builder /go/bin/dex /usr/local/bin/dex Affected range >=0 Fixed version Not Fixed EPSS Score 0.06% EPSS Percentile 27th percentile Description Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/dexidp/dex from v2.37.0 before v2.38.0.

busybox 1.36.1-r28 (apk) pkg:apk/alpine/busybox@1.36.1-r28?os_name=alpine&os_version=3.20 # Dockerfile (38:57) FROM alpine:3.20.0@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd AS stager RUN mkdir -p /var/dex RUN mkdir -p /etc/dex COPY config.docker.yaml /etc/dex/ FROM alpine:3.20.0@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd AS gomplate ARG TARGETOS ARG TARGETARCH ARG TARGETVARIANT ENV GOMPLATE_VERSION=v3.11.8 RUN wget -O /usr/local/bin/gomplate \ "https://github.com/hairyhenderson/gomplate/releases/download/${GOMPLATE_VERSION}/gomplate_${TARGETOS:-linux}-${TARGETARCH:-amd64}${TARGETVARIANT}" \ && chmod +x /usr/local/bin/gomplate # For Dependabot to detect base image versions FROM alpine:3.20.0@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd AS alpine Affected range <1.36.1-r29 Fixed version 1.36.1-r30 EPSS Score 0.04% EPSS Percentile 14th percentile Description Affected range <1.36.1-r29 Fixed version 1.36.1-r30 EPSS Score 0.04% EPSS Percentile 14th percentile Description

github.com/aws/aws-sdk-go 1.44.206 (golang) pkg:golang/github.com/aws/aws-sdk-go@1.44.206 # Dockerfile (80:80) COPY --from=gomplate /usr/local/bin/gomplate /usr/local/bin/gomplate Affected range >=0 Fixed version Not Fixed EPSS Score 0.05% EPSS Percentile 21st percentile Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client. Affected range >=0 Fixed version Not Fixed EPSS Score 0.04% EPSS Percentile 14th percentile Description The Go AWS S3 Crypto SDK contains vulnerabilities that can permit an attacker with write access to a bucket to decrypt files in that bucket. Files encrypted by the V1 EncryptionClient using either the AES-CBC content cipher or the KMS key wrap algorithm are vulnerable. Users should migrate to the V1 EncryptionClientV2 API, which will not create vulnerable files. Old files will remain vulnerable until re-encrypted with the new client.

gopkg.in/square/go-jose.v2 2.6.0 (golang) pkg:golang/gopkg.in/square/go-jose.v2@2.6.0 # Dockerfile (80:80) COPY --from=gomplate /usr/local/bin/gomplate /usr/local/bin/gomplate Improper Handling of Highly Compressed Data (Data Amplification) Affected range <=2.6.0 Fixed version Not Fixed CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.05% EPSS Percentile 18th percentile Description Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting. Patches The problem is fixed in the following packages and versions: github.com/go-jose/go-jose/v4 version 4.0.1 github.com/go-jose/go-jose/v3 version 3.0.3 gopkg.in/go-jose/go-jose.v2 version 2.6.3 The problem will not be fixed in the following package because the package is archived: gopkg.in/square/go-jose.v2

github.com/hashicorp/go-retryablehttp 0.7.1 (golang) pkg:golang/github.com/hashicorp/go-retryablehttp@0.7.1 # Dockerfile (80:80) COPY --from=gomplate /usr/local/bin/gomplate /usr/local/bin/gomplate Insertion of Sensitive Information into Log File Affected range <0.7.7 Fixed version 0.7.7 CVSS Score 6 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N EPSS Score 0.04% EPSS Percentile 10th percentile Description go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

google.golang.org/grpc 1.64.0 (golang) pkg:golang/google.golang.org/grpc@1.64.0 # Dockerfile (76:76) COPY --from=builder /go/bin/dex /usr/local/bin/dex Exposure of Sensitive Information to an Unauthorized Actor Affected range >=1.64.0 <1.64.1 Fixed version 1.64.1 Description Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. Patches The issue first appeared in 1.64.0 and is patched in 1.64.1 and 1.65.0 Workarounds If using an affected version and upgrading is not possible, ensuring you do not log or print contexts will avoid the problem.