RubySec

Providing security resources for the Ruby community

CVE-2020-24393 (tweetstream): Improper Certificate Validation in TweetStream

ADVISORIES

GEM

tweetstream

SEVERITY

CVSS v3: 5.9

PATCHED VERSIONS

None.

DESCRIPTION

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.