PT-2020-14214

Name of the Vulnerable Software and Affected Versions Faye versions prior to 1.4.0 Description The issue is related to a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket, which rely on the EM::Connectionstart tls method in EventMachine. This method...

Missing TLS certificate verification

Faye uses em-http-request6 and faye-websocket10 in the Ruby version of its client. Those libraries both use the EM::Connectionstarttls1 method in EventMachine2 to implement the TLS handshake whenever a wss: URL is used for the connection. This method does not implement certificate verification by...

Man-in-the-middle (MitM)

em-http-request is vulnerable to man-in-the-middle MitM. It uses the library eventmachine insecurely as it misses SSL/TLS certificate hostname verification, allowing a man-in-the-middle attack against the users of the library...

CVE-2020-13482

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

Design/Logic Flaw

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

CVE-2020-13482

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

CVE-2020-13482

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

CVE-2020-13482

CVE-2020-13482 affects EM-HTTP-Request (1.1.5) using EventMachine, where TLS server certificate hostname verification is not performed. This allows potential MITM attacks affecting confidentiality and integrity. Public advisories (e.g., Red Hat RHSA-2021-0937, Mageia MGASA-2021-0172) confirm the ...

CVE-2020-13482: Improper Certificate Validation

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

PT-2020-13565

Name of the Vulnerable Software and Affected Versions EM-HTTP-Request version 1.1.5 Description The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a TLS...

Code injection

em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

CVE-2020-13163

CVE-2020-13163 affects em-imap (v0.5 and earlier) where TLS server certificate hostname verification is not performed due to insecure use of the EventMachine library, enabling potential MITM attacks. The available connected sources consistently describe the vulnerability in basic terms and refere...

CVE-2020-13163

em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

PT-2020-13366

Name of the Vulnerable Software and Affected Versions em-imap versions 0.5 and earlier Description The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a...

CVE-2020-13163: Improper Certificate Validation

em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

MGASA-2016-0276 Updated ruby-eventmachine packages fix security vulnerability

EventMachine could be crashed by opening a high number of parallel connections = 1024 towards a server using the EventMachine engine. The crash happens due to the file descriptors overwriting the stack...

Updated ruby-eventmachine packages fix security vulnerability

EventMachine could be crashed by opening a high number of parallel connections = 1024 towards a server using the EventMachine engine. The crash happens due to the file descriptors overwriting the stack...

PT-2016-7970

Name of the Vulnerable Software and Affected Versions EventMachine affected versions not specified Description The issue concerns a potential crash of EventMachine when opening a high number of parallel connections, specifically 1024 or more, to a server using the EventMachine engine. This crash...

Debian DLA-549-1 : ruby-eventmachine security update

EventMachine, a Ruby network engine could be crashed by opening a high number of parallel connections = 1024 towards a server using the EventMachine engine. The crash happens due to the file descriptors overwriting the stack. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DLA 549-1] ruby-eventmachine security update

Package : ruby-eventmachine Version : 0.12.10-3+deb7u1 Debian Bug : 678512 696015 EventMachine, a Ruby network engine could be crashed by opening a high number of parallel connections = 1024 towards a server using the EventMachine engine. The crash happens due to the file descriptors overwriting...