Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

EM-HTTP-Request 1.1.5: Fails to Verify Server Certificate

CVE-2020-13482 · published 6 years ago
Summary

Using EM-HTTP-Request 1.1.5 may allow hackers to intercept your connection to a website. An attacker can pretend to be a trusted server by presenting a fake certificate. To fix this, update to a newer version of EM-HTTP-Request that properly verifies server certificates.

What to do
  • Update ilya grigorik em-http-request to version 1.1.6.
Affected software
Ecosystem VendorProductAffected versions
rubygems ilya grigorik em-http-request <= 1.1.5
Fix: upgrade to 1.1.6
– em-http-request_project em-http-request 1.1.5
cpe:2.3:a:em-http-request_project:em-http-request:1.1.5:*:*:*:*:*:*:*
– fedoraproject fedora 32
33
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Original advisory text
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certi...
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published25 May 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-q27f-v3r6-9v77 · GHSA
CVE-2020-13482 · NVD
Track software like this
Free during beta