# Snyk test report

December 15th 2024, 12:24:25 am (UTC+00:00)

Scanned the following paths:

- ghcr.io/dexidp/dex:v2.41.1/dexidp/dex (apk)
- ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4//usr/local/bin/gomplate (gomodules)
- ghcr.io/dexidp/dex:v2.41.1/dexidp/dex//usr/local/bin/docker-entrypoint (gomodules)
- ghcr.io/dexidp/dex:v2.41.1/dexidp/dex//usr/local/bin/dex (gomodules)

23 known vulnerabilities
44 vulnerable dependency paths
969 dependencies

## Incorrect Implementation of Authentication Algorithm

critical severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and golang.org/x/crypto/ssh@v0.24.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › golang.org/x/crypto/ssh@v0.24.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm when the key passed in the last call before a connection is established is assumed to be the key used for authentication. It is not necessarily the authentication key in use, and this allows attackers who can control the key cache by making their own carefully-timed connections to bypass authorization with subsequent legitimate `ServerConfig.PublicKeyCallback` callbacks.

Note: The assumed caching behavior of this callback is not documented and is therefore considered human error, but the project maintainers have observed reliance on it for authorization decisions in production. In fact, the assumption is negated in the documentation, which states "A call to this function does not guarantee that the key offered is in fact used to authenticate." The behavior after upgrading still allows the possibility of an attacker forcing their own key to be the one in the cache when the callback is invoked if the client is using a different authentication method such as `PasswordCallback`, `KeyboardInteractiveCallback`, or `NoClientAuth`. It is therefore recommended to rely on the return values of the connection itself, found in `ServerConn.Permissions` for further authorization steps.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.31.0 or higher.

## References

- GitHub Commit
- GitHub Issue
- go.dev Commit
- go.dev Issue
- Google Groups Forum
- Go Vulnerability Database

More about this vulnerability

## Insertion of Sensitive Information into Log File

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Vulnerable module: google.golang.org/grpc/metadata
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and google.golang.org/grpc/metadata@v1.64.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › google.golang.org/grpc/metadata@v1.64.0

## Overview

google.golang.org/grpc/metadata is a package that defines the structure of the metadata supported by the gRPC library

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of gRPC metadata. If the metadata contains sensitive information an attacker can expose it.

## Remediation

Upgrade `google.golang.org/grpc/metadata` to version 1.64.1 or higher.

## References

- GitHub Commit

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/vault/api
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/vault/api@v1.14.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/vault/api@v1.14.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/serf/coordinate
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/serf/coordinate@v0.10.1

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/serf/coordinate@v0.10.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/dexidp/dex › /usr/local/bin/dex
- Package Manager: golang
- Module: github.com/hashicorp/hcl/v2
- Introduced through: github.com/dexidp/dex@* and github.com/hashicorp/hcl/v2@v2.13.0

### Detailed paths

- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/ext/customdecode@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/ext/tryfunc@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/gohcl@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/hclparse@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/hclsyntax@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/hclwrite@v2.13.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/json@v2.13.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/hcl
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/hcl@v1.0.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/hcl@v1.0.0
- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/hcl/hcl/token@v1.0.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/golang-lru/simplelru
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/golang-lru/simplelru@v1.0.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/golang-lru/simplelru@v1.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-uuid
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-uuid@v1.0.3

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-uuid@v1.0.3

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-sockaddr
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-sockaddr@v1.0.6

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-sockaddr@v1.0.6
- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-sockaddr/template@v1.0.6

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-secure-stdlib/strutil
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-secure-stdlib/parseutil
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-secure-stdlib/parseutil@v0.1.8

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-secure-stdlib/parseutil@v0.1.8

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-secure-stdlib/awsutil
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-secure-stdlib/awsutil@v0.3.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-secure-stdlib/awsutil@v0.3.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-rootcerts
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-rootcerts@v1.0.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-rootcerts@v1.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-retryablehttp
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-retryablehttp@v0.7.7

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-retryablehttp@v0.7.7

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-multierror
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-multierror@v1.1.1

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-multierror@v1.1.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-immutable-radix
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-immutable-radix@v1.3.1

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-immutable-radix@v1.3.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-cleanhttp
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/go-cleanhttp@v0.5.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/go-cleanhttp@v0.5.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/errwrap
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/errwrap@v1.1.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/errwrap@v1.1.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/consul/api
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/hashicorp/consul/api@v1.29.1

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/hashicorp/consul/api@v1.29.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/hairyhenderson/gomplate/v4 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/gosimple/slug
- Introduced through: github.com/hairyhenderson/gomplate/v4@* and github.com/gosimple/slug@v1.14.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v4@* › github.com/gosimple/slug@v1.14.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.41.1/dexidp/dex › /usr/local/bin/dex
- Package Manager: golang
- Module: github.com/go-sql-driver/mysql
- Introduced through: github.com/dexidp/dex@* and github.com/go-sql-driver/mysql@v1.8.1

### Detailed paths

- Introduced through: github.com/dexidp/dex@* › github.com/go-sql-driver/mysql@v1.8.1

MPL-2.0 license

More about this vulnerability

## CVE-2024-6119

low severity

- Package Manager: alpine:3.20
- Vulnerable module: openssl/libcrypto3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 and openssl/libcrypto3@3.3.1-r3

### Detailed paths

- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › apk-tools/apk-tools@2.14.4-r0 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › busybox/ssl_client@1.36.1-r29 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › apk-tools/apk-tools@2.14.4-r0 › openssl/libssl3@3.3.1-r3 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › openssl/libssl3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › apk-tools/apk-tools@2.14.4-r0 › openssl/libssl3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › busybox/ssl_client@1.36.1-r29 › openssl/libssl3@3.3.1-r3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Alpine`. See `How to fix?` for `Alpine:3.20` relevant fixed versions and status.

Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process.

Impact summary: Abnormal termination of an application can a cause a denial of service.

Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program.

Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address.

TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

## Remediation

Upgrade `Alpine:3.20` `openssl` to version 3.3.2-r0 or higher.

## References

- https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f
- https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6
- https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2
- https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0
- https://openssl-library.org/news/secadv/20240903.txt
- http://www.openwall.com/lists/oss-security/2024/09/03/4
- https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html
- https://security.netapp.com/advisory/ntap-20240912-0001/

More about this vulnerability

## CVE-2024-9143

low severity

- Package Manager: alpine:3.20
- Vulnerable module: openssl/libcrypto3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 and openssl/libcrypto3@3.3.1-r3

### Detailed paths

- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › apk-tools/apk-tools@2.14.4-r0 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › busybox/ssl_client@1.36.1-r29 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › apk-tools/apk-tools@2.14.4-r0 › openssl/libssl3@3.3.1-r3 › openssl/libcrypto3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › openssl/libssl3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › apk-tools/apk-tools@2.14.4-r0 › openssl/libssl3@3.3.1-r3
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.41.1 › busybox/ssl_client@1.36.1-r29 › openssl/libssl3@3.3.1-r3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Alpine`. See `How to fix?` for `Alpine:3.20` relevant fixed versions and status.

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.

Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a vulnerable application is low.

In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an "exotic" curve encoding.

The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.

Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

## Remediation

Upgrade `Alpine:3.20` `openssl` to version 3.3.2-r1 or higher.

## References

- https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712
- https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700
- https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4
- https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154
- https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a
- https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41
- https://openssl-library.org/news/secadv/20241016.txt
- http://www.openwall.com/lists/oss-security/2024/10/16/1
- http://www.openwall.com/lists/oss-security/2024/10/23/1
- http://www.openwall.com/lists/oss-security/2024/10/24/1
- https://security.netapp.com/advisory/ntap-20241101-0001/

More about this vulnerability