search

ideal-postcodes / ideal-postcodes-ruby

UK postcode lookup API using Royal Mail's Postcode Address File.
https://ideal-postcodes.co.uk
MIT License
12 stars 3 forks source link

Update minimum required version of rest-client gem #5

Closed vnagasivam closed 7 years ago

vnagasivam commented 7 years ago

Current version of rest-client that is a dependency is 1.6.7, which has 2 vulnerabilities:

Name: rest-client Version: 1.6.7 Advisory: CVE-2015-3448 Criticality: Unknown URL: http://www.osvdb.org/show/osvdb/117461 Title: Rest-Client Gem for Ruby logs password information in plaintext Solution: upgrade to >= 1.7.3

Name: rest-client Version: 1.6.7 Advisory: CVE-2015-1820 Criticality: Unknown URL: https://github.com/rest-client/rest-client/issues/369 Title: rubygem-rest-client: session fixation vulnerability via Set-Cookie headers in 30x redirection responses Solution: upgrade to >= 1.8.0

cblanc commented 7 years ago

Thanks for raising this. rest-client has been bumped to 1.8.0 in version 1.1.0 of this gem