GHSA-779w-xvpm-78jx

twitch-tui's connection is not encrypted

Source: GitHub Advisory Database (reviewed) High CVE-2023-38688

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	twitch-tui	< 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The connection is not using TLS for communication ### Details In the configuration of the irc connection, [you are disabling tls](https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23) which makes all communication to twitch irc servers unencrypted. ### PoC You can verify by using tcpdump/wireshark that traffic is unencrypted. ### Impact Communication can be sniffed, even auth tokens.

References

External links from the advisory. They lead to third-party sites.

https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx web
https://nvd.nist.gov/vuln/detail/CVE-2023-38688 advisory
https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a web
https://github.com/Xithrius/twitch-tui package
https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23 web