doc note for CVE-2021-33564

markevans · May 26, 2021 · ec8da75 · ec8da75
1 parent 35e88d1
commit ec8da75
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/History.md b/History.md
@@ -6,7 +6,7 @@
 
 ## Fixes
 
-- Better security for all job steps with parameter validations
+- Better security for all job steps with parameter validations - addresses CVE-2021-33564
 
 # 1.3.0 (2021-01-09)
 

diff --git a/README.md b/README.md
@@ -47,7 +47,7 @@ Installation
 
 or in your Gemfile
 ```ruby
-gem 'dragonfly', '~> 1.2.2'
+gem 'dragonfly', '~> 1.4.0'
 ```
 
 Require with
@@ -72,6 +72,12 @@ See [the Add-ons wiki](http://github.com/markevans/dragonfly/wiki/Dragonfly-add-
 
 Please feel free to contribute!!
 
+Security notice!
+=================
+If you have set `verify_urls` to `false` (which is **not** recommended) then you should upgrade to version `1.4.x` for a security fix ([CVE-2021-33564](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33564).
+
+Please feel free to contribute!!
+
 Issues
 ======
 Please use the <a href="http://github.com/markevans/dragonfly/issues">github issue tracker</a> if you have any issues.