CVE-2023-38688

twitch-tui's connection is not encrypted

CVSS 7.5 HIGHEPSS 0.4%CWE-311

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

04 Aug 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Xithrius · twitch-tui

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx