CVE-2020-13482: Improper Certificate Validation

May 25, 2020 (updated February 24, 2021)

EM-HTTP-Request uses the library eventmachine insecurely, allowing an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.

References

github.com/igrigorik/em-http-request/issues/339
nvd.nist.gov/vuln/detail/CVE-2020-13482

Detect and mitigate CVE-2020-13482 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →