PT-2023-26552 · Unknown · Twitch-Tui

Roger · Publicado 2023-07-31 · Atualizado 2023-08-09 · CVE-2023-38688

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions twitch-tui versions prior to 2.4.1

Description The issue arises from the software's configuration of the IRC connection, which disables TLS, resulting in unencrypted communication to Twitch IRC servers. This allows communication, including auth tokens, to be sniffed.

Recommendations For versions prior to 2.4.1, update to version 2.4.1 to resolve the issue. As a temporary workaround, consider configuring the IRC connection to enable TLS until the update can be applied.

Exploit

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2023-38688

GHSA-779W-XVPM-78JX

Produtos afetados

Twitch-Tui

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38688.json · Exploit
• https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 · Nota
• https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx · Aviso do Fabricante
• https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a · Correção
• https://github.com/Xithrius/twitch-tui · Nota
• https://t.me/cibsecurity/67771 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38688 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-38688 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-779w-xvpm-78jx · Aviso do Fabricante