{"action":"Upgrade ruby-faye-websocket to 0.11.0-1 or later.","affected":[{"fixed":"0.11.0-1","introduced":"0"}],"component":"ruby-faye-websocket","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["0.11.0-1"],"id":"tcs_01M5NEMT7M02FJTCP2XZDYXY8T","modified_at":"2026-09-11T11:01:25.304764074Z","published_at":"2020-07-31T18:15:14.473Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-15133","https://security-tracker.debian.org/tracker/CVE-2020-15133"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-15133","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-15133"}],"summary":"In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine t"}