Bug 1911457 (CVE-2020-13482) - CVE-2020-13482 rubygem-em-http-request: missing SSL hostname validation allows MITM
Summary: CVE-2020-13482 rubygem-em-http-request: missing SSL hostname validation allow...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-13482
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1911458 1913523
Blocks: 1911459
TreeView+ depends on / blocked
 
Reported: 2020-12-29 14:44 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-06-16 01:15 UTC (History)
11 users (show)

Fixed In Version: rubygem-em-http-request 1.1.6
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in rubygem-em-http-request. The eventmachine library does not verify the hostname in a TLS server certificate which can allow an attacker to perform a man-in-the-middle attack. The highest threat from this vulnerability is to data confidentiality and integrity.
Clone Of:
Environment:
Last Closed: 2021-03-18 13:51:45 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0937 0 None None None 2021-03-18 13:02:12 UTC

Description Guilherme de Almeida Suckevicz 2020-12-29 14:44:19 UTC 
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.

Reference:
https://github.com/igrigorik/em-http-request/issues/339
Comment 1 Guilherme de Almeida Suckevicz 2020-12-29 14:44:35 UTC 
Created rubygem-em-http-request tracking bugs for this issue:

Affects: fedora-all [bug 1911458]
Comment 6 Summer Long 2021-01-07 03:30:41 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 8 Summer Long 2021-01-07 04:12:19 UTC 
Additional patch for warnings: https://github.com/igrigorik/em-http-request/commit/157d5ff281c503656192825c388b28e7f35e04ce
Comment 9 errata-xmlrpc 2021-03-18 13:02:04 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 Operational Tools for RHEL 7

Via RHSA-2021:0937 https://access.redhat.com/errata/RHSA-2021:0937
Comment 10 Product Security DevOps Team 2021-03-18 13:51:45 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-13482
Note You need to log in before you can comment on or make changes to this bug.