RubyGems/faye-websocket CVE-2020-15133: high 8, EPSS 1.06%

Missing TLS certificate verification in faye-websocket

Action: Upgrade faye-websocket to 0.11.0 or later.

bundle update faye-websocket

Affected

Fixed versions

Sources

• osv: GHSA-2v5c-755p-p4gv
• https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gv
• https://nvd.nist.gov/vuln/detail/CVE-2020-15133
• https://github.com/eventmachine/eventmachine/issues/275
• https://github.com/eventmachine/eventmachine/issues/814
• https://github.com/faye/faye/issues/524
• https://github.com/eventmachine/eventmachine/pull/378
• https://github.com/faye/faye-websocket-ruby/pull/129
• https://github.com/igrigorik/em-http-request/pull/340
• https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye
• https://github.com/faye/faye-websocket-ruby
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye-websocket/CVE-2020-15133.yml
• https://securitylab.github.com/advisories/GHSL-2020-094-igrigorik-em-http-request
• https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer
• https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls

CVE-2020-15133 · published 2020-07-31T17:40:04Z · modified 2026-09-10T03:48:51.742639999Z · JSON