JMESPath for Ruby using JSON.load instead of JSON.parse
Published: June 07, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2022-32511 (NVD)
- GHSA: GHSA-5c5f-7vfq-3732
GEM
SEVERITY
PATCHED VERSIONS
>= 1.6.1
DESCRIPTION
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2022-32511
- https://github.com/jmespath/jmespath.rb/blob/main/CHANGELOG.md#161-2022-03-07
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
- https://github.com/jmespath/jmespath.rb/pull/55
- https://github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49
- https://stackoverflow.com/a/30050571/580231
- https://github.com/advisories/GHSA-5c5f-7vfq-3732