{"action":"Upgrade faye-websocket to 0.11.0 or later.","affected":[{"fixed":"0.11.0","introduced":"0"}],"component":"faye-websocket","cve_ids":["CVE-2020-15133"],"ecosystem":"RubyGems","epss":0.00918,"exploited":false,"fixed_versions":["0.11.0"],"ghsa_id":"GHSA-2v5c-755p-p4gv","id":"tcs_01M5KEG159JSQRXZ8NN5NRYTZJ","modified_at":"2026-09-10T03:48:51.742639999Z","published_at":"2020-07-31T17:40:04Z","references":["https://osv.dev/vulnerability/GHSA-2v5c-755p-p4gv","https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gv","https://nvd.nist.gov/vuln/detail/CVE-2020-15133","https://github.com/eventmachine/eventmachine/issues/275","https://github.com/eventmachine/eventmachine/issues/814","https://github.com/faye/faye/issues/524","https://github.com/eventmachine/eventmachine/pull/378","https://github.com/faye/faye-websocket-ruby/pull/129","https://github.com/igrigorik/em-http-request/pull/340","https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye","https://github.com/faye/faye-websocket-ruby","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye-websocket/CVE-2020-15133.yml","https://securitylab.github.com/advisories/GHSL-2020-094-igrigorik-em-http-request","https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer","https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-2v5c-755p-p4gv","url":"https://osv.dev/vulnerability/GHSA-2v5c-755p-p4gv"}],"summary":"Missing TLS certificate verification in faye-websocket"}