{"action":"Upgrade ruby-faye-websocket to 0.11.0-1 or later.","affected":[{"fixed":"0.11.0-1","introduced":"0"}],"component":"ruby-faye-websocket","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.11.0-1"],"id":"tcs_01M5NEMTB8B08GY5WMBY2KEP29","modified_at":"2026-10-26T12:00:24.082152019Z","published_at":"2020-07-31T18:15:14.473Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-15133","https://security-tracker.debian.org/tracker/CVE-2020-15133"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-15133#Debian:13/ruby-faye-websocket","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-15133"}],"summary":"In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine t"}