CVE-2020-13163 Improper certificate validation in em-imap
Attackers can intercept IMAP traffic via man-in-the-middle attacks because the library fails to verify TLS server hostnames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-13163?
CVE-2020-13163 is a high-severity vulnerability in n/a, published on 19 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Weakness: CWE-295
Which versions are affected by CVE-2020-13163?
2 open source packages ship an affected version, including em-imap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
em-imap RubyGems | All versions to 0.5 | None |
em-imap RubyGems | All versions to 0.5 | None |
Products include Em-Imap Project Em-Imap.
How do I fix CVE-2020-13163?
No fix has been published for CVE-2020-13163 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-13163 being exploited?
There is no known exploitation of CVE-2020-13163 in the wild and no public exploit code.
Sources
Also known as GHSA-4f68-49qq-h392.