chargebee / chargebee-ruby

Ruby library for the Chargebee API.

https://apidocs.chargebee.com/docs/api?lang=ruby

Dependency on CGI version with vulnerability '<=0.1.0'

williantenfen opened this issue 3 years ago · comments

Willian Tenfen Wazilewski commented 3 years ago

CGI '0.1.0' gem is vulnerable (https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/), there's a patch for it '0.1.1' .

Willian Tenfen Wazilewski commented 3 years ago

sorry, just saw a PR for it now

Willian Tenfen Wazilewski commented 3 years ago

Anyway, is there a way to do patches for old versions? like '2.8.8.1'

ignore, I think there's no breaking changes on higher versions.. I'll just upgrade when new version with fix is available...