CVE-2022-28352

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-02 · updated 2026-06-17
Weakness: CWE-295

Description

WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.

Affected products

weechat: from 3.2 before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: weechat 3.4.1. Check the vendor advisory for mitigations.

References

https://github.com/weechat/weechat/issues/1763
https://weechat.org/doc/security/WSA-2022-1/
https://github.com/weechat/weechat/issues/1763
https://weechat.org/doc/security/WSA-2022-1/

Get alerted when CVE-2022-28352 or the next vulnerability affects your stack