Description
Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect use of the GnuTLS API.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | weechat | 0.3.5-1 | — |
| Debian 13 | weechat | 0.3.5-1 | — |
| Debian 12 | weechat | 0.3.5-1 | — |
| Debian 6.0 | weechat | 0.3.2-1+squeeze1 | DSA-2598-1 |
Advisories 1
- DSA-2598-1 weechat - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://savannah.nongnu.org/patch/index.php?7459
- 46612 vdb-entry
- http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commit%3Bh=c265cad1c95b84abfd4e8d861f25926ef13b5d91
- 20110227 weechat does not properly use gnutls and allow an attacker to bypass certificate verification mailing-list
- 43543 third-party-advisory