CVE-2020-13482: 
Ruby vulnerability analysis and mitigation

EM-HTTP-Request version 1.1.5 contains a security vulnerability (CVE-2020-13482) that was discovered in May 2020. The vulnerability exists in the way the library uses eventmachine, specifically in its SSL/TLS certificate validation implementation. The issue affects the EventMachine based, async HTTP Request client library (GitHub Advisory, NVD).

The vulnerability stems from missing SSL/TLS certificate hostname validation in the em-http-request library. When establishing SSL/TLS connections, the library fails to properly verify the hostname in the server's TLS certificate, which is a critical security check for establishing secure connections (GitHub Advisory).

The vulnerability allows attackers to perform man-in-the-middle (MITM) attacks against users of the library. An attacker can successfully impersonate a trusted server and introduce malicious data in an otherwise trusted communication channel (GitHub Advisory, Red Hat).

The vulnerability can be exploited by creating a TLS-enabled listening daemon with a fake certificate. An attacker can set up a malicious server that presents an invalid certificate, and due to the missing hostname validation, the client will accept the connection as legitimate (GitHub Issue).

The vulnerability was fixed in version 1.1.7 of the em-http-request library. Users are advised to upgrade to this version or later. The fix implements proper hostname validation for SSL/TLS certificates (Fedora Update).