CVE-2022-28352: Medium severity WeeChat WeeChat vulnerability
WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutlscasystem or weechat.network.gnutlscauser is changed without a WeeChat restart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/weechatto a version that resolves this vulnerability.Fixed in 3.8-1Fixed in 4.6.3-1Fixed in 4.10.0-1 - Upgrade
Upgrade
alpine/weechatto a version that resolves this vulnerability.Fixed in 3.5-r0 - Upgrade
Upgrade
debian/weechatto a version that resolves this vulnerability.Fixed in 3.4.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28352?
CVE-2022-28352 is considered a critical vulnerability due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2022-28352?
To fix CVE-2022-28352, upgrade WeeChat to version 3.4.1 or later, which properly verifies TLS certificates.
What versions of WeeChat are affected by CVE-2022-28352?
CVE-2022-28352 affects WeeChat versions 3.2 through 3.4 before 3.4.1.
What type of vulnerability is CVE-2022-28352?
CVE-2022-28352 is a TLS certificate verification vulnerability that can be exploited for man-in-the-middle attacks.
Who can be affected by CVE-2022-28352?
Users of WeeChat versions 3.2 to 3.4 prior to 3.4.1 are at risk of being affected by CVE-2022-28352.