PT-2023-26552 · Unknown · Twitch-Tui

Roger · Published 2023-07-31 · Updated 2023-08-09 · CVE-2023-38688

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions twitch-tui versions prior to 2.4.1

Description The issue arises from the software's configuration of the IRC connection, which disables TLS, resulting in unencrypted communication to Twitch IRC servers. This allows communication, including auth tokens, to be sniffed.

Recommendations For versions prior to 2.4.1, update to version 2.4.1 to resolve the issue. As a temporary workaround, consider configuring the IRC connection to enable TLS until the update can be applied.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2023-38688

GHSA-779W-XVPM-78JX

Affected Products

Twitch-Tui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38688.json · Exploit
• https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx · Vendor Advisory
• https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-38688 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38688 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-779w-xvpm-78jx · Vendor Advisory
• https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 · Note
• https://github.com/Xithrius/twitch-tui · Note
• https://t.me/cibsecurity/67771 · Telegram Post