Critical vulnerability in tap-chargebee dependency `urllib3`

singer-io / tap-chargebee

Singer.io tap for extracting data from the Chargebee API

https://www.singer.io/

GNU Affero General Public License v3.0

7 stars 32 forks source link

Critical vulnerability in tap-chargebee dependency `urllib3` #108

Open benw-at-birdie opened 8 months ago

benw-at-birdie commented 8 months ago

Hi there

Versions of urllib3 before version 1.23 have a critical vulnerability: https://nvd.nist.gov/vuln/detail/cve-2018-20060.

The current version of urllib installed by tap-chargebee is 1.22. Updating to the next minor version will fix the vulnerability. Is it possible to upgrade?

Kind regards Ben