high7.5
CVE-2023-38688
twitch-tui's connection is not encrypted
Impact
### Summary The connection is not using TLS for communication ### Details In the configuration of the irc connection, [you are disabling tls](https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23) which makes all communication to twitch irc servers unencrypted. ### PoC You can verify by using tcpdump/wireshark that traffic is unencrypted. ### Impact Communication can be sniffed, even auth tokens.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | twitch-tui | < 2.4.1 | 2.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xithrius | Twitch-Tui | through 2.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23
- https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a
- https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx
- https://github.com/advisories/GHSA-779w-xvpm-78jx
- https://nvd.nist.gov/vuln/detail/CVE-2023-38688