What is GHSA-4f68-49qq-h392?

GHSA-4f68-49qq-h392 is a security advisory published by GitHub Security Advisories with High severity. Improper certificate validation in em-imap

Which CVE IDs does GHSA-4f68-49qq-h392 cover?

GHSA-4f68-49qq-h392 covers the following CVE IDs: CVE-2020-13163. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4f68-49qq-h392?

GHSA-4f68-49qq-h392 has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

Which products are affected by GHSA-4f68-49qq-h392?

GHSA-4f68-49qq-h392 affects 1 product, including: rubygems/em-imap:\u003c= 0.5.

GHSA-4f68-49qq-h392HighCVSS 7.4

Improper certificate validation in em-imap

Vendor

GitHub Security Advisories

Published

May 24, 2021

Last Modified

September 5, 2023

🔗 CVE IDs covered (1)

CVE-2020-13163 →

📋 Description

em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.

🎯 Affected products1

rubygems/em-imap:<= 0.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-13163
https://github.com/ConradIrwin/em-imap/issues/25
https://securitylab.github.com/advisories/GHSL-2020-095-conradirwin-em-imap
https://github.com/advisories/GHSA-4f68-49qq-h392