CVE-2022-32511: Critical severity Jmespath Project Jmespath Ruby vulnerability
Published Jun 6, 2022
·Updated
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
Affected Software
4 affected components
Jmespath Project Jmespath Ruby<1.6.1
Fedoraproject Fedora=35
Fedoraproject Fedora=36
jmespath Jmespath Ruby<1.6.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jmespath.rbto a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Jun 6, 2022
CVE Published
via MITRE·09:55 PM
Data Sourced
via MITRE·09:55 PM
Description
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-32511?
CVE-2022-32511 has a low severity level due to its limited impact on the affected software.
2
How do I fix CVE-2022-32511?
To resolve CVE-2022-32511, upgrade jmespath.rb to version 1.6.1 or later.
3
Which versions of jmespath.rb are affected by CVE-2022-32511?
CVE-2022-32511 affects jmespath.rb versions prior to 1.6.1.
4
Are Fedora distributions affected by CVE-2022-32511?
Yes, Fedora versions 35 and 36 are affected by CVE-2022-32511.
5
Is CVE-2022-32511 specific to Ruby applications?
Yes, CVE-2022-32511 specifically impacts the JMESPath library for Ruby.