EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform
    a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not
    verified. (CVE-2020-13482)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0937 advisory.

    EventMachine based, async HTTP Request client.

    Security Fix(es):

    * missing SSL hostname validation allows MITM (CVE-2020-13482)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2020-13482.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2020-13482

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
417796	SCA: security update for em-http-request (GHSA-q27f-v3r6-9v77)	Tenable Cloud Security	SCA Checks	Local	high
417796	SCA: security update for em-http-request (GHSA-q27f-v3r6-9v77)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
147880	RHEL 7 : rubygem-em-http-request (RHSA-2021:0937)	Nessus	Red Hat Local Security Checks	Local	high
144834	Fedora 32 : rubygem-em-http-request (2020-117f1b67fb)	Nessus	Fedora Local Security Checks	Local	high
144827	Fedora 33 : rubygem-em-http-request (2020-8ccd750904)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2020-13482

high

Tenable Plugins

high

high

high

high

high