CVE-2022-32511

EUVD-2022-5934
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
jmespath_projectjmespath
𝑥
< 1.6.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-jmespath
bookworm
1.6.1-1
fixed
bullseye
no-dsa
sid
1.6.1-1
fixed
trixie
1.6.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-jmespath
bionic
dne
focal
needed
impish
ignored
jammy
needed
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
trusty
dne
xenial
dne
References
https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
https://github.com/jmespath/jmespath.rb/pull/55
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
https://stackoverflow.com/a/30050571/580231
https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
https://github.com/jmespath/jmespath.rb/pull/55
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5/
https://stackoverflow.com/a/30050571/580231