CVE-2020-24392

Name of the Vulnerable Software and Affected Versions: voloko twitter-stream version 0.1.10 voloko twitter-stream version 0.1.16

Description: The issue is related to missing TLS hostname validation, which allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the misuse of eventmachine.

Recommendations: For voloko twitter-stream version 0.1.10, consider updating to a version where the TLS hostname validation issue is fixed. For voloko twitter-stream version 0.1.16, consider updating to a version where the TLS hostname validation issue is fixed. As a temporary workaround, consider restricting the use of the eventmachine until a patch is available.