Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

faye-websocket

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.0RubyGemsPublished

    Missing TLS certificate verification in faye-websocket

    CVE-2020-15133 · GHSA-2v5c-755p-p4gv

    Affected
    • RubyGems faye-websocket < 0.11.0
    Fixed in
    0.11.0· Vendor fix available
    Issue
    The Faye::WebSocket::Client class uses the [EM::Connection#starttls][1] method in [EventMachine][2] to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any wss: connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. This has been a requested feature in EventMachine for many years now; see for example [#275][3], [#378][4], and [#814][5]. In June 2020, [em-http-request][6] published an [advisory][7] related to this problem and fixed it by [implementing TLS verification][8] in their own codebase; although EventMachine does not implement certificate verification itself, it provides an extension point for the caller to implement it, called [sslverifypeer][9]. Based…

    Recommended action: Upgrade to 0.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →