GitHub Advisoryadvisory · crates.io

GHSA-779w-xvpm-78jx twitch-tui's connection is not encrypted

HIGH Published 2023-07-31 Modified 2023-08-04 Official page ↗
Aliases
CVE-2023-38688
Ecosystem
crates.io
Packages
twitch-tui
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-311
Reviewed
2023-07-31

Affected packages

• crates.io twitch-tui: < 2.4.1 → fixed in 2.4.1

Description

Summary The connection is not using TLS for communication Details In the configuration of the irc connection, you are disabling tls which makes all communication to twitch irc servers unencrypted. PoC You can verify by using tcpdump/wireshark that traffic is unencrypted. Impact Communication can be sniffed, even auth tokens.

Related

Alias · CVE (1)

  • CVE-2023-38688 twitch-tui provides Twitch chat in a terminal. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References