CVE-2024-45337 in golang.org/x/crypto

[MoeBensu]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I am not looking for support or already pursued the available support channels without success.

Version

2.41. and latest master (#d521051)

Storage Type

Kubernetes

Installation Type

Official container image

Expected Behavior

High/Critical vulnerability-free docker image

Actual Behavior

Running trivy image -v dexidp/dex:latest-alpine

Steps To Reproduce

run trivy scan on any current dex image

Additional Information

A fix is available in v0.31.0. Gomplate also had a new release v4.3.0 with a fix for the CVE.
Could you please assess whether dex is affected by this critical CVE in golang.org/x/crypto or a dependency used in dex? Thank you!

Configuration

No response

Logs

No response