{"id":"CVE-2020-24393","aliases":["EUVD-2021-0775","GHSA-6hrm-jqp3-64cv"],"status":"published","title":"Improper Certificate Validation in TweetStream","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00859,"percentile":0.58951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2021-02-19T22:44:56Z","modified":"2026-10-20T10:52:51Z","affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"tweetstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"tweetstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.1"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.7","0.1.8","0.1.9","0.3.0","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.1.0.rc1","1.1.0.rc2","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","2.0.0","2.0.1","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1"]}],"products":[{"vendor":"tweetstream_project","product":"tweetstream"}],"references":[{"url":"https://github.com/tweetstream/tweetstream","tags":["x_refsource_MISC","x_transferred","Product","package"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-096-tweetstream-tweetstream","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24393","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6hrm-jqp3-64cv"}],"sources":{"cve":[{"id":"CVE-2020-24393","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","status":"published","published":"2021-02-19T22:44:56Z","modified":"2024-08-04T15:12:08.682Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2021-0775","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","status":"published","published":"2021-02-19T22:44:56Z","modified":"2024-08-04T15:12:08Z","updated_at":"2026-11-03T03:07:19.775117Z"}],"ghsa":[{"id":"GHSA-6hrm-jqp3-64cv","title":"Improper Certificate Validation in TweetStream","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","status":"published","published":"2021-04-13T15:42:36Z","modified":"2023-01-26T22:35:32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:36:14.825433Z"}],"nvd":[{"id":"CVE-2020-24393","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","status":"published","published":"2021-02-19T23:15:12.483Z","modified":"2026-06-17T03:05:29.193Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-24393","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","status":"published","published":"2021-02-19T23:15:12.483Z","modified":"2026-10-20T10:52:51.265739918Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"GHSA-6hrm-jqp3-64cv","title":"Improper Certificate Validation in TweetStream","description":"TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.","status":"published","published":"2021-04-13T15:42:36Z","modified":"2023-11-08T04:03:07.210453Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}