Skip to content

Product

debian/ruby-faye vulnerabilities

2 published CVES affecting debian/ruby-faye, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest debian/ruby-faye CVEs

Newest publication first

  1. CVE-2020-15134 Missing TLS certificate verification in Faye

    Published
    HighCVSS 8.7 EPSS 0.86% PoC

    Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the EM::Connection#start_tls method in EventMachine to implement the TLS handshake wh...

  2. CVE-2020-11020 Authentication and extension bypass in Faye

    Published
    CriticalCVSS 9.8 EPSS 1.6% PoC

    Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.