Skip to content
OpenAdvisories

Package · Debian

ruby-faye

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.0
    CVE-2020-15134

    Missing TLS certificate verification in Faye

    Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the `EM::Connection#start_tls` method in EventMachine to impleme…

    faye faye ruby-faye faye Debian Ubuntu RubyGems
  • High 8.5
    CVE-2020-11020

    Authentication and extension bypass in Faye

    Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending e…

    faye faye faye ruby-faye Debian Ubuntu RubyGems