CVE-2022-32511
קריטית 9.8
תיאור (מקור, אנגלית)
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
מדדים
- CVSS 3.1
-
9.8 (CRITICAL)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 2% (אחוזון 100) נכון ל-15/10/2026
מוצרים מושפעים
jmespath: jmespath; fedoraproject: fedora
קישורים
- https://github.com/jmespath/jmespath.rb/pull/55 PatchThird Party Advisory
- https://github.com/jmespath/jmespath.rb/pull/55 PatchThird Party Advisory
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://stackoverflow.com/a/30050571/580231 Third Party Advisory
- https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://stackoverflow.com/a/30050571/580231 Third Party Advisory