New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependency: httparty (~> 0.13.3) depends on json (~> 1.8) which has a CVE #39

Open

pboling opened this issue Apr 2, 2020 · 0 comments

pboling commented Apr 2, 2020 •

edited

Loading

from bundle-audit:

Name: json
Version: 1.8.6
Advisory: CVE-2020-10663
Criticality: Unknown
URL: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
Title: json Gem for Ruby Unsafe Object Creation Vulnerability (additional fix)
Solution: upgrade to >= 2.3.0

@grnhse Please loosen the dependency on httparty so that we can use this gem without the vulnerability.
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

The text was updated successfully, but these errors were encountered:

panozzaj mentioned this issue

Refresh version requirements #42

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment