Hi, On Wed, Jul 22, 2026 at 12:18:30PM +0000, [email protected] wrote: > Source: weechat > > weechat 4.9.4 was released a few days ago [1] and claims to fix 2 > security vulnerabilites. First vulnerability is likely only exploitable > by a malicious IRC server [2]. The other vulnerability is in the relay > code, and has been assigned GHSA-68ff-gq39-pqjm [3] and the fix is in > [4]. > > Please update weechat in debian. Thank you. > > [1] https://weechat.org/news/180/20260719-Version-4.9.4/ > [2] https://github.com/weechat/weechat/pull/2340 > [3] https://github.com/weechat/weechat/security/advisories/GHSA-68ff-gq39-pqjm > [4] > https://github.com/weechat/weechat/commit/1a89d796c9cd5d99fcaafd76de55b20540efd4cc
Thank you for fixing this in unstable. I'd like to see at least GHSA-68ff-gq39-pqjm be fixed in trixie too, as that is reachable directly and is a trivial authentication bypass. Leading to takeover of weechat sessions. I'm attaching a diff against the version in stable, which I've verified to work. Emmanuel, Security - should this go via trixie-updates instead of security? If so, Emmanuel, can you propose this to trixie-updates? Many thanks, Chris
diff -Nru weechat-4.6.3/debian/changelog weechat-4.6.3/debian/changelog --- weechat-4.6.3/debian/changelog 2025-05-17 07:49:46.000000000 +0200 +++ weechat-4.6.3/debian/changelog 2026-08-15 22:21:57.000000000 +0200 @@ -1,3 +1,10 @@ +weechat (4.6.3-1.1) trixie-security; urgency=medium + + * Non-maintainer upload. + * Backport patch for GHSA-68ff-gq39-pqjm. + + -- Chris Hofstaedtler <[email protected]> Sat, 15 Aug 2026 22:21:57 +0200 + weechat (4.6.3-1) unstable; urgency=medium * New upstream release diff -Nru weechat-4.6.3/debian/patches/1a89d796c9cd5d99fcaafd76de55b20540efd4cc.patch weechat-4.6.3/debian/patches/1a89d796c9cd5d99fcaafd76de55b20540efd4cc.patch --- weechat-4.6.3/debian/patches/1a89d796c9cd5d99fcaafd76de55b20540efd4cc.patch 1970-01-01 01:00:00.000000000 +0100 +++ weechat-4.6.3/debian/patches/1a89d796c9cd5d99fcaafd76de55b20540efd4cc.patch 2026-08-15 22:21:31.000000000 +0200 @@ -0,0 +1,106 @@ +From 1a89d796c9cd5d99fcaafd76de55b20540efd4cc Mon Sep 17 00:00:00 2001 +From: mohammed arib <[email protected]> +Date: Sun, 19 Jul 2026 16:31:45 +0530 +Subject: [PATCH] relay: fix authentication bypass with the "plain" password + hash algorithm + +relay_auth_password_hash() dispatches on the password hash algorithm with a +switch that had no case for RELAY_AUTH_PASSWORD_HASH_PLAIN (enum value 0) and +no default. As rc is pre-initialized to 0 (authentication OK), a client that +submits the "plain" algo through the hash form (api protocol +"Authorization: Basic" decoding to "hash:plain:", or weechat protocol +"init password_hash=plain:" after negotiating password_hash_algo=plain) ran +no case and the function returned 0, authenticating the client with no password +check. The default relay.network.password_hash_algo="*" matches "plain", so +the guard passes. + +Add the missing "plain" case (rejected here; plain is validated only by +relay_auth_check_password_plain) and a default arm for defense in depth. Add +unit tests covering relay_auth_password_hash, including the plain-algo +rejection on both the api and weechat protocols. + +Signed-off-by: mohammed arib <[email protected]> +--- + CHANGELOG.md | 1 + + src/plugins/relay/relay-auth.c | 12 ++++++ + tests/unit/plugins/relay/test-relay-auth.cpp | 43 +++++++++++++++++++- + 3 files changed, 55 insertions(+), 1 deletion(-) + +--- a/src/plugins/relay/relay-auth.c ++++ b/src/plugins/relay/relay-auth.c +@@ -499,6 +499,15 @@ + + switch (hash_algo) + { ++ case RELAY_AUTH_PASSWORD_HASH_PLAIN: ++ /* ++ * plain password is not handled here: it is checked by the ++ * function relay_auth_check_password_plain; receiving the "plain" ++ * algo in a hashed password means the client is trying to ++ * authenticate with the wrong form, so it is rejected ++ */ ++ rc = -1; ++ break; + case RELAY_AUTH_PASSWORD_HASH_SHA256: + case RELAY_AUTH_PASSWORD_HASH_SHA512: + relay_auth_parse_sha ( +@@ -552,6 +561,9 @@ + case RELAY_NUM_PASSWORD_HASH_ALGOS: + rc = -4; + break; ++ default: ++ rc = -1; ++ break; + } + + end: +--- a/tests/unit/plugins/relay/test-relay-auth.cpp ++++ b/tests/unit/plugins/relay/test-relay-auth.cpp +@@ -482,5 +482,46 @@ + + TEST(RelayAuth, PasswordHash) + { +- /* TODO: write tests */ ++ struct t_relay_client *client; ++ ++ client = (struct t_relay_client *)calloc (1, sizeof (*client)); ++ CHECK(client); ++ client->protocol = RELAY_PROTOCOL_API; ++ ++ /* invalid arguments */ ++ LONGS_EQUAL(-4, relay_auth_password_hash (client, NULL, NULL)); ++ LONGS_EQUAL(-4, relay_auth_password_hash (client, "sha256:abcd", NULL)); ++ LONGS_EQUAL(-4, relay_auth_password_hash (client, NULL, "password")); ++ ++ /* missing separator between algo and hash */ ++ LONGS_EQUAL(-4, relay_auth_password_hash (client, "", "password")); ++ LONGS_EQUAL(-4, relay_auth_password_hash (client, "sha256", "password")); ++ ++ /* unknown hash algorithm */ ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, ":abcd", "password")); ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "zzz:abcd", "password")); ++ ++ /* ++ * algo "plain" must always be rejected in a hashed password: it is ++ * checked by relay_auth_check_password_plain, and accepting it here ++ * would authenticate the client without any password check ++ */ ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "plain:", "password")); ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "plain:test", "password")); ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "plain:password", ++ "password")); ++ ++ /* same test with protocol "weechat", after "plain" was negotiated */ ++ client->protocol = RELAY_PROTOCOL_WEECHAT; ++ client->password_hash_algo = RELAY_AUTH_PASSWORD_HASH_PLAIN; ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "plain:", "password")); ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "plain:password", ++ "password")); ++ ++ /* no authentication supported with protocol "weechat" */ ++ client->password_hash_algo = -1; ++ LONGS_EQUAL(-1, relay_auth_password_hash (client, "sha256:abcd", ++ "password")); ++ ++ free (client); + } diff -Nru weechat-4.6.3/debian/patches/series weechat-4.6.3/debian/patches/series --- weechat-4.6.3/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ weechat-4.6.3/debian/patches/series 2026-08-15 22:21:09.000000000 +0200 @@ -0,0 +1 @@ +1a89d796c9cd5d99fcaafd76de55b20540efd4cc.patch
