GHSA-p6p8-q4pj-f74m
Improper Certificate Validation in twitter-stream
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | twitter-stream | <= 0.1.16 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
References
External links from the advisory. They lead to third-party sites.