GitHub Advisoryadvisory · RubyGems

GHSA-6hrm-jqp3-64cv Improper Certificate Validation in TweetStream

MEDIUM Published 2021-04-13 Modified 2023-01-26 Official page ↗
Aliases
CVE-2020-24393
Ecosystem
RubyGems
Packages
tweetstream
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2021-03-29

Affected packages

• RubyGems tweetstream: <= 2.6.1 (no fix yet)

Description

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.

Related

Alias · CVE (1)

  • CVE-2020-24393 TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References