Versions 1.0.0 up to 1.2.9 are also vulnerable, not just the 0.x branch. Edit: misread your comment, 1.x is vulnerable only if you have the tzinfo-data gem ins

Versions 1.0.0 up to 1.2.9 are also vulnerable, not just the 0.x branch. Edit: misread your comment, 1.x is vulnerable only if you have the tzinfo-data gem installed, or explicitly set TZInfo::DataSource to DataSources::RubyDataSource as you stated.