{"action":"Upgrade faye to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"faye","cve_ids":["CVE-2020-15134"],"ecosystem":"RubyGems","epss":0.00864,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-3q49-h8f9-9fr9","id":"tcs_01M5KEGDAQJR4YFNMYK80NGMJD","modified_at":"2026-07-08T06:00:15.827873392Z","published_at":"2020-07-31T17:39:42Z","references":["https://osv.dev/vulnerability/GHSA-3q49-h8f9-9fr9","https://github.com/faye/faye/security/advisories/GHSA-3q49-h8f9-9fr9","https://nvd.nist.gov/vuln/detail/CVE-2020-15134","https://github.com/eventmachine/eventmachine/issues/275","https://github.com/eventmachine/eventmachine/issues/814","https://github.com/faye/faye/issues/524","https://github.com/eventmachine/eventmachine/pull/378","https://github.com/faye/faye-websocket-ruby/pull/129","https://github.com/igrigorik/em-http-request/pull/340","https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye","https://github.com/faye/faye","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-15134.yml","https://securitylab.github.com/advisories/GHSL-2020-094-igrigorik-em-http-request","https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:ssl_verify_peer","https://www.rubydoc.info/github/eventmachine/eventmachine/EventMachine/Connection:start_tls"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-3q49-h8f9-9fr9","url":"https://osv.dev/vulnerability/GHSA-3q49-h8f9-9fr9"}],"summary":"Missing TLS certificate verification"}