HIGH7.5

GHSA-779w-xvpm-78jx

twitch-tui's connection is not encrypted

Details

### Summary The connection is not using TLS for communication

### Details In the configuration of the irc connection, [you are disabling tls](https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23) which makes all communication to twitch irc servers unencrypted.

### PoC You can verify by using tcpdump/wireshark that traffic is unencrypted.

### Impact Communication can be sniffed, even auth tokens.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/twitch-tui

Introduced in: 0Fixed in: 2.4.1

Upgrade twitch-tui to 2.4.1 or newer (ecosystem crates.io).

References

https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-38688[ADVISORY]
https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a[WEB]
https://github.com/Xithrius/twitch-tui[PACKAGE]
https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23[WEB]