GHSA-6hrm-jqp3-64cv
Improper Certificate Validation in TweetStream
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | tweetstream | <= 2.6.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
References
External links from the advisory. They lead to third-party sites.