Skip to content
Threat Feed
Subscribe

Product

Gist (< 6.1.0)

1 brief RSS
high advisory

Improper SSL/TLS Certificate Validation in gist RubyGem

The gist RubyGem versions prior to 6.1.0 contain an improper certificate validation vulnerability that allows on-path attackers to intercept and modify GitHub API traffic by exploiting the hardcoded use of OpenSSL::SSL::VERIFY_NONE.

gist vulnerability supply-chain ruby mitm
2t 1c