Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[REF] Upgrade Guzzle to 6.5.6 #23584

Merged
merged 1 commit into from
May 25, 2022
Merged

[REF] Upgrade Guzzle to 6.5.6 #23584

merged 1 commit into from
May 25, 2022

Conversation

seamuslee001
Copy link
Contributor

@civibot
Copy link

civibot bot commented May 25, 2022

(Standard links)

@totten
Copy link
Member

totten commented May 26, 2022

It should be noted for anyone following along - this was sent in because Guzzle had a security update (as linked in the dependabot PR). However, for Civi, it appears unlikely to have an actual impact; it's only prophylactic.

  • The security-issue affects cookie-handling in Guzzle, but you have to opt-in to enable cookies (eg by setting cookies and/or creating a CookieJar). Grepping civicrm-core, the opt-in only appears in a few internal test files.
  • Similarly, I couldn't find any cookie opt-ins in the universe of published extensions that might rely on Civi's copy of Guzzle.
  • So we haven't run this through the full rigamarole of a security release for civicrm.
  • Of course, it's hard to say that it's impossible to exploit. (Maybe some private add-on uses Guzzle cookies?)
  • So it's definitely good to include this update at the nearest convenience.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants