CVE-2023-38688

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38688
twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 Product
https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a Patch
https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx Vendor Advisory
https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 Product
https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a Patch
https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xithrius:twitch-tui:*:*:*:*:*:rust:*:*
History

21 Nov 2024, 08:14

Type Values Removed Values Added
References () https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 - Product () https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 - Product
References () https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a - Patch () https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a - Patch
References () https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx - Vendor Advisory () https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx - Vendor Advisory
Summary
  • (es) twitch-tui proporciona el chat de Twitch en un terminal. Antes de la versión 2.4.1, la conexión no utiliza TLS para la comunicación. En la configuración de la conexión irc, el software deshabilita TLS, lo que hace que toda la comunicación con los servidores IRC de Twitch no esté cifrada. Como resultado, la comunicación, incluyendo los tokens de autenticación, puede ser interceptada. La versión 2.4.1 tiene un parche para este problema.

09 Aug 2023, 21:05

Type Values Removed Values Added
CPE cpe:2.3:a:xithrius:twitch-tui:*:*:*:*:*:rust:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a - (MISC) https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a - Patch
References (MISC) https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 - (MISC) https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 - Product
References (MISC) https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx - (MISC) https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx - Vendor Advisory

04 Aug 2023, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-08-04 17:15

Updated : 2024-11-21 08:14

NVD link : CVE-2023-38688

Mitre link : CVE-2023-38688

CVE.ORG link : CVE-2023-38688

JSON object : View

Products Affected

xithrius

  • twitch-tui
CWE
CWE-311

Missing Encryption of Sensitive Data