CVE-2023-38688
Assigner: GitHub_M
Published: 2023-08-04T16:18:15.288Z
State: PUBLISHED
title: twitch-tui's connection is not encrypted
problemTypes: descriptions: cweId: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
affected: vendor: Xithrius
product: twitch-tui
versions: version:  < 2.4.1
status: affected
descriptions: value: twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.
source: advisory: GHSA-779w-xvpm-78jx
discovery: UNKNOWN