CVE-2024-23656: Github.com/dexidp/dex Dex Discarding TLSconfig And Always Vulnerability

Q: What is CVE-2024-23656?

CVE-2024-23656 is a security vulnerability in Github.com/dexidp/dex involving Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers under CWE-326: Inadequate Encryption Strength.

Q: Which Github.com/dexidp/dex versions are affected?

Affected versions include releases prior to 2.38.0, 0.0.0-20240125115555-5bbdb4420254 across affected packages: github.com/dexidp/dex.

Q: What version fixes CVE-2024-23656?

Upgrading to 2.38.0, 0.0.0-20240125115555-5bbdb4420254 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is github.com/dexidp/dex affected?

Yes, github.com/dexidp/dex is affected in releases prior to 2.38.0, 0.0.0-20240125115555-5bbdb4420254. Upgrade your dependency to 2.38.0, 0.0.0-20240125115555-5bbdb4420254 or later.

Q: What is the CVSS score of CVE-2024-23656?

CVE-2024-23656 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Q: What CWE is associated with CVE-2024-23656?

CVE-2024-23656 is classified under CWE-326: Inadequate Encryption Strength (The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.).

Q: How can I check Go dependencies for CVE-2024-23656?

Run the dependency tree command: 'inspect dependencies for github.com/dexidp/dex'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-gr79-9v6v-gc9r

CVSS 7.5

CWE-326

Published 2024-01-26

Advisory Summary

CVE-2024-23656 is a HIGH (CVSS 7.5) dex discarding tlsconfig and always vulnerability (CWE-326: Inadequate Encryption Strength) affecting Github.com/dexidp/dex libraries in the Go ecosystem. The issue involves dex discarding tlsconfig and always serves deprecated tls 1.0/1.1 and insecure ciphers. Remediation is available by upgrading affected packages to version 2.38.0, 0.0.0-20240125115555-5bbdb4420254.

CVE-2024-23656 at a Glance

CVE Identifier CVE-2024-23656

GHSA Identifier GHSA-gr79-9v6v-gc9r

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-326: Inadequate Encryption Strength

Affected Product Github.com/dexidp/dex

Package Ecosystem Go

Published Date 2024-01-26

Last Updated 2025-05-27

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2024-23656

To remediate this vulnerability, upgrade all affected Github.com/dexidp/dex dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/dexidp/dex fixed: 2.38.0

Upgrade github.com/dexidp/dex to 2.38.0

github.com/dexidp/dex fixed: 0.0.0-20240125115555-5bbdb4420254

Upgrade github.com/dexidp/dex to 0.0.0-20240125115555-5bbdb4420254

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for github.com/dexidp/dex

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-23656, inspect your project dependencies for Github.com/dexidp/dex:

inspect dependencies for github.com/dexidp/dex

Analyze the terminal output to locate any version of Github.com/dexidp/dex in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.38.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-326: Inadequate Encryption Strength, where the product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. In Github.com/dexidp/dex, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Dex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1. ### Details While working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating. https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425 is seemingly setting TLS 1.2 as minimum version, but the whole tlsConfig is ignored after "TLS cert reloader" was introduced in https://github.com/dexidp/dex/pull/2964. Configured cipher suites are not respected either, as seen on the output. ### PoC Build Dex, generate certs with `gencert.sh`, modify `config.dev.yaml` to run on https, using generated certs. ```console issuer: http://127.0.0.1:5556/dex storage: type: sqlite3 config: file: dex.db web: https: 127.0.0.1:5556 tlsCert: examples/k8s/ssl/cert.pem tlsKey: examples/k8s/ssl/key.pem <rest as default> ``` Run dex `bin/dex serve config.dev.yaml`. Install `sslyze`, easy to use SSL connection analyzer: ```console pip3 install sslyze sslyze 127.0.0.1:5556 ``` In Dex 2.37.0, TLS 1.0 and TLS 1.1 are enabled in addition to expected TLS 1.2 and TLS 1.3. ```console * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 6 cipher suites: TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites. The server accepted the following 6 cipher suites: TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 11 cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_256_CBC_SHA 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_RSA_WITH_AES_128_CBC_SHA 128 TLS_RSA_WITH_3DES_EDE_CBC_SHA 168 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 168 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) TLS_AES_128_GCM_SHA256 128 ECDH: X25519 (253 bits) ``` In Dex 2.36.0, TLS 1.0 and TLS 1.1 are disabled as expected. ```console * TLS 1.0 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.1 Cipher Suites: Attempted to connect using 80 cipher suites; the server rejected all cipher suites. * TLS 1.2 Cipher Suites: Attempted to connect using 156 cipher suites. The server accepted the following 5 cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 256 TLS_RSA_WITH_AES_128_GCM_SHA256 128 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 ECDH: prime256v1 (256 bits) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 ECDH: prime256v1 (256 bits) The group of cipher suites supported by the server has the following properties: Forward Secrecy OK - Supported Legacy RC4 Algorithm OK - Not Supported * TLS 1.3 Cipher Suites: Attempted to connect using 5 cipher suites. The server accepted the following 3 cipher suites: TLS_CHACHA20_POLY1305_SHA256 256 ECDH: X25519 (253 bits) TLS_AES_256_GCM_SHA384 256 ECDH: X25519 (253 bits) ``` ### Impact TLS 1.0 and TLS 1.1 connections can be decrypted by the attacker, and hence decrypt the traffic to Dex.

CVE-2024-23656 Affected Github.com/dexidp/dex Versions

2 component(s)

Fixed Versions:

2.38.00.0.0-20240125115555-5bbdb4420254

Product / Package	Ecosystem	Affected Versions	Fixed Version
github.com/dexidp/dex golang/github.com/dexidp/dex	Go	≥ 2.37.0 < 2.38.0 All 1 versions 2.37.0	2.38.0
github.com/dexidp/dex golang/github.com/dexidp/dex	Go	< 0.0.0-20240125115555-5bbdb4420254	0.0.0-20240125115555-5bbdb4420254

References

GitHub Advisory / Wiki ADVISORY

https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r

NVD — CVE-2024-23656 NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-23656

Github.com/dexidp/dex Source Repository REPOSITORY

https://github.com/dexidp/dex/issues/2848

Github.com/dexidp/dex Source Repository REPOSITORY

https://github.com/dexidp/dex/pull/2964

Security Fix Commit FIX COMMIT

https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17

Github.com/dexidp/dex Source Repository REPOSITORY

https://github.com/dexidp/dex

Github.com/dexidp/dex Source Repository REPOSITORY

https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425

Frequently Asked Questions

What is CVE-2024-23656?

CVE-2024-23656 is a security vulnerability in Github.com/dexidp/dex involving Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers under CWE-326: Inadequate Encryption Strength.

Which Github.com/dexidp/dex versions are affected?

Affected versions include releases prior to 2.38.0, 0.0.0-20240125115555-5bbdb4420254 across affected packages: github.com/dexidp/dex.

What version fixes CVE-2024-23656?

Upgrading to 2.38.0, 0.0.0-20240125115555-5bbdb4420254 (or the latest patched release for your respective branch) resolves the vulnerability.

Is github.com/dexidp/dex affected?

Yes, github.com/dexidp/dex is affected in releases prior to 2.38.0, 0.0.0-20240125115555-5bbdb4420254. Upgrade your dependency to 2.38.0, 0.0.0-20240125115555-5bbdb4420254 or later.

What is the CVSS score of CVE-2024-23656?

CVE-2024-23656 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

What CWE is associated with CVE-2024-23656?

CVE-2024-23656 is classified under CWE-326: Inadequate Encryption Strength (The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.).

How can I check Go dependencies for CVE-2024-23656?

Run the dependency tree command: 'inspect dependencies for github.com/dexidp/dex'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gr79-9v6v-gc9r",
  "modified" : "2025-05-27T15:45:13Z",
  "published" : "2024-01-26T01:57:31Z",
  "aliases" : [ "CVE-2024-23656" ],
  "summary" : "Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers",
  "details" : "### Summary\n\nDex 2.37.0 is serving HTTPS with insecure TLS 1.0 and TLS 1.1.\n\n\n### Details\nWhile working on https://github.com/dexidp/dex/issues/2848 and implementing configurable TLS support, I noticed my changes did not have any effect in TLS config, so I started investigating. \n\nhttps://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425 is seemingly setting TLS 1.2 as minimum version, but the whole tlsConfig is ignored after \"TLS cert reloader\" was introduced in https://github.com/dexidp/dex/pull/2964. Configured cipher suites are not respected either, as seen on the output.\n\n### PoC\nBuild Dex, generate certs with `gencert.sh`, modify `config.dev.yaml` to run on https, using generated certs.\n\n```console\nissuer: http://127.0.0.1:5556/dex\n\nstorage:\n  type: sqlite3\n  config:\n    file: dex.db\n\nweb:\n  https: 127.0.0.1:5556\n  tlsCert: examples/k8s/ssl/cert.pem\n  tlsKey: examples/k8s/ssl/key.pem\n\n<rest as default>\n```\n\nRun dex `bin/dex serve config.dev.yaml`.\n\nInstall `sslyze`, easy to use SSL connection analyzer:\n\n```console\npip3 install sslyze\nsslyze 127.0.0.1:5556\n```\n\nIn Dex 2.37.0, TLS 1.0 and TLS 1.1 are enabled in addition to expected TLS 1.2 and TLS 1.3.\n```console\n * TLS 1.0 Cipher Suites:\n     Attempted to connect using 80 cipher suites.\n\n     The server accepted the following 6 cipher suites:\n        TLS_RSA_WITH_AES_256_CBC_SHA                      256                      \n        TLS_RSA_WITH_AES_128_CBC_SHA                      128                      \n        TLS_RSA_WITH_3DES_EDE_CBC_SHA                     168                      \n        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                256       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                128       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA               168       ECDH: prime256v1 (256 bits)\n\n     The group of cipher suites supported by the server has the following properties:\n       Forward Secrecy                    OK - Supported\n       Legacy RC4 Algorithm               OK - Not Supported\n\n\n * TLS 1.1 Cipher Suites:\n     Attempted to connect using 80 cipher suites.\n\n     The server accepted the following 6 cipher suites:\n        TLS_RSA_WITH_AES_256_CBC_SHA                      256                      \n        TLS_RSA_WITH_AES_128_CBC_SHA                      128                      \n        TLS_RSA_WITH_3DES_EDE_CBC_SHA                     168                      \n        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                256       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                128       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA               168       ECDH: prime256v1 (256 bits)\n\n     The group of cipher suites supported by the server has the following properties:\n       Forward Secrecy                    OK - Supported\n       Legacy RC4 Algorithm               OK - Not Supported\n\n\n * TLS 1.2 Cipher Suites:\n     Attempted to connect using 156 cipher suites.\n\n     The server accepted the following 11 cipher suites:\n        TLS_RSA_WITH_AES_256_GCM_SHA384                   256                      \n        TLS_RSA_WITH_AES_256_CBC_SHA                      256                      \n        TLS_RSA_WITH_AES_128_GCM_SHA256                   128                      \n        TLS_RSA_WITH_AES_128_CBC_SHA                      128                      \n        TLS_RSA_WITH_3DES_EDE_CBC_SHA                     168                      \n        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256       256       ECDH: X25519 (253 bits)\n        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384             256       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                256       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256             128       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                128       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA               168       ECDH: prime256v1 (256 bits)\n\n     The group of cipher suites supported by the server has the following properties:\n       Forward Secrecy                    OK - Supported\n       Legacy RC4 Algorithm               OK - Not Supported\n\n\n * TLS 1.3 Cipher Suites:\n     Attempted to connect using 5 cipher suites.\n\n     The server accepted the following 3 cipher suites:\n        TLS_CHACHA20_POLY1305_SHA256                      256       ECDH: X25519 (253 bits)\n        TLS_AES_256_GCM_SHA384                            256       ECDH: X25519 (253 bits)\n        TLS_AES_128_GCM_SHA256                            128       ECDH: X25519 (253 bits)\n```\n\nIn Dex 2.36.0, TLS 1.0 and TLS 1.1 are disabled as expected.\n```console\n * TLS 1.0 Cipher Suites:\n     Attempted to connect using 80 cipher suites; the server rejected all cipher suites.\n\n * TLS 1.1 Cipher Suites:\n     Attempted to connect using 80 cipher suites; the server rejected all cipher suites.\n\n * TLS 1.2 Cipher Suites:\n     Attempted to connect using 156 cipher suites.\n\n     The server accepted the following 5 cipher suites:\n        TLS_RSA_WITH_AES_256_GCM_SHA384                   256                      \n        TLS_RSA_WITH_AES_128_GCM_SHA256                   128                      \n        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256       256       ECDH: X25519 (253 bits)\n        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384             256       ECDH: prime256v1 (256 bits)\n        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256             128       ECDH: prime256v1 (256 bits)\n\n     The group of cipher suites supported by the server has the following properties:\n       Forward Secrecy                    OK - Supported\n       Legacy RC4 Algorithm               OK - Not Supported\n\n\n * TLS 1.3 Cipher Suites:\n     Attempted to connect using 5 cipher suites.\n\n     The server accepted the following 3 cipher suites:\n        TLS_CHACHA20_POLY1305_SHA256                      256       ECDH: X25519 (253 bits)\n        TLS_AES_256_GCM_SHA384                            256       ECDH: X25519 (253 bits)\n```\n\n### Impact\nTLS 1.0 and TLS 1.1 connections can be decrypted by the attacker, and hence decrypt the traffic to Dex.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/dexidp/dex"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.37.0"
      }, {
        "fixed" : "2.38.0"
      } ]
    } ],
    "versions" : [ "2.37.0" ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/dexidp/dex"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20240125115555-5bbdb4420254"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/security/advisories/GHSA-gr79-9v6v-gc9r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-23656"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/issues/2848"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/pull/2964"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dexidp/dex"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-326" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-01-26T01:57:31Z",
    "nvd_published_at" : "2024-01-25T20:15:41Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Advisory Metadata

Source ID: GHSA-gr79-9v6v-gc9r
Schema Version: 1.4.0
Published: 2024-01-26 01:57
Last Modified: 2025-05-27 15:45
Database Record File: advisories/github-reviewed/2024/01/GHSA-gr79-9v6v-gc9r/GHSA-gr79-9v6v-gc9r.json