Bug 2072045 (CVE-2022-28352) - CVE-2022-28352 weechat: allows man-in-the-middle attackers to spoof a TLS chat server
Summary: CVE-2022-28352 weechat: allows man-in-the-middle attackers to spoof a TLS cha...
Keywords:
Status: NEW
Alias: CVE-2022-28352
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2072046
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-04-05 13:42 UTC by Marian Rehak
Modified: 2023-07-07 08:27 UTC (History)
6 users (show)

Fixed In Version: weechat 3.4.1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2022-04-05 13:42:59 UTC 
WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.

Reference:

https://weechat.org/doc/security/WSA-2022-1/
https://github.com/weechat/weechat/issues/1763
Comment 1 Marian Rehak 2022-04-05 13:43:15 UTC 
Created weechat tracking bugs for this issue:

Affects: epel-7 [bug 2072046]
Note You need to log in before you can comment on or make changes to this bug.