Vulnerability Description
WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Weechat | Weechat | >= 3.2, < 3.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/weechat/weechat/issues/1763ExploitIssue TrackingMitigation
- https://weechat.org/doc/security/WSA-2022-1/ExploitVendor Advisory
- https://github.com/weechat/weechat/issues/1763ExploitIssue TrackingMitigation
- https://weechat.org/doc/security/WSA-2022-1/ExploitVendor Advisory
FAQ
What is CVE-2022-28352?
CVE-2022-28352 is a vulnerability with a CVSS score of 4.3 (MEDIUM). WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-mi...
How severe is CVE-2022-28352?
CVE-2022-28352 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-28352?
Check the references section above for vendor advisories and patch information. Affected products include: Weechat Weechat.