RubyGems/faye CVE-2020-15134: high 8, EPSS 0.86%

Missing TLS certificate verification

Action: Upgrade faye to 1.4.0 or later.

bundle update faye

Affected

Fixed versions

Sources

• osv: GHSA-3q49-h8f9-9fr9
• https://github.com/faye/faye/security/advisories/GHSA-3q49-h8f9-9fr9
• https://nvd.nist.gov/vuln/detail/CVE-2020-15134
• https://github.com/eventmachine/eventmachine/issues/275
• https://github.com/eventmachine/eventmachine/issues/814
• https://github.com/faye/faye/issues/524
• https://github.com/eventmachine/eventmachine/pull/378
• https://github.com/faye/faye-websocket-ruby/pull/129
• https://github.com/igrigorik/em-http-request/pull/340
• https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye
• https://github.com/faye/faye
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-15134.yml
• https://securitylab.github.com/advisories/GHSL-2020-094-igrigorik-em-http-request
• https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer
• https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls

CVE-2020-15134 · published 2020-07-31T17:39:42Z · modified 2026-07-08T06:00:15.827873392Z · JSON