CVE-2022-32511

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
VendorProductVersion
jmespath_projectjmespath
𝑥
< 1.6.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-jmespath
bullseye
no-dsa
sid
1.6.1-1
fixed
trixie
1.6.1-1
fixed
bookworm
1.6.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-jmespath
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needed
impish
ignored
focal
needed
bionic
dne
xenial
dne
trusty
dne
References
https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
https://github.com/jmespath/jmespath.rb/pull/55
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
https://stackoverflow.com/a/30050571/580231
https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
https://github.com/jmespath/jmespath.rb/pull/55
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
https://stackoverflow.com/a/30050571/580231