GHSA-5c5f-7vfq-3732
JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-32511
- https://github.com/jmespath/jmespath.rb/pull/55
- https://github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49
- https://github.com/jmespath/jmespath.rb
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jmespath/CVE-2022-32511.yml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/376NUPIPTYBWWGS33GO4UOLQRI4D3BTP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AGZ2YWONVFFOPACHAT4MM7ZBT4DNHOF5
- https://stackoverflow.com/a/30050571/580231