medium5.9
CVE-2020-24392
Improper Certificate Validation in twitter-stream
Impact
In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | twitter-stream | <= 0.1.16 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Twitter-Stream Project | Twitter-Stream | Version 0.1.10 |