CVE-2016-11086

The CVE-2016-11086 entry concerns the oauth-ruby gem (lib/oauth/consumer.rb) up to version 0.5.4 for Ruby, where server X.509 certificate verification is skipped if a certificate bundle cannot be found. This allows man-in-the-middle attackers to spoof the server and obtain sensitive information. ...