CVE-2022-28352: 
NixOS vulnerability analysis and mitigation

WeeChat (aka Wee Enhanced Environment for Chat) versions 3.2 to 3.4 before 3.4.1 contains a TLS certificate verification vulnerability (CVE-2022-28352) discovered in March 2022. The vulnerability affects the chat client's handling of TLS certificate verification after certain GnuTLS options are changed (WeeChat Security).

The vulnerability occurs when the options weechat.network.gnutlscasystem or weechat.network.gnutlscauser are modified during a session. After these changes, the TLS verification function is lost, causing the client to fail to properly verify server certificates. This only affects situations where these GnuTLS options are changed without a WeeChat restart (WeeChat Security, CVE Details).

When the vulnerability is triggered, any subsequent TLS connections to servers are made without proper certificate verification. This affects both IRC server connections and any server connections made by plugins or scripts using the hook_connect function. The vulnerability has a CVSS score of 4.3/10, indicating medium severity (WeeChat Security).

The vulnerability was fixed in WeeChat version 3.4.1. For affected versions, users must restart WeeChat after changing the weechat.network.gnutlscasystem or weechat.network.gnutlscauser options to ensure proper TLS certificate verification (WeeChat Security).