CVE-2020-13163: Improper Certificate Validation

May 19, 2020 (updated March 4, 2021)

em-imap uses the library eventmachine insecurely, allowing an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.

References

nvd.nist.gov/vuln/detail/CVE-2020-13163

Code Behaviors & Features

Detect and mitigate CVE-2020-13163 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →