CVE-2022-32511(fedoraproject / fedora)

LOWCVSS 9.8 · CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

0.5/ 10 priority

Sources & remediation

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fedora
  • jmespath

Affected systems

Products
fedorajmespath

2 versions affected across 2 products

Deep dive

Full discourse1 post
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2022-32511 (CVSS 9.8) jmespath[.]rb for Ruby <1.6.1 uses unsafe JSON[.]load instead of JSON[.]parse, enabling remote code execution. Update to v1.6.1+ immediately. #CVE #Vulnerability #PatchNow https://t.co/ntCet302zj

    Post summary

    The tweet alerts to CVE‑2022‑32511, explains how unsafe JSON.load in jmespath.rb allows remote code execution, and urges immediate upgrade to v1.6.1+.

    0000024
    44 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
OSfedoraprojectfedora35--
OSfedoraprojectfedora36--
Appjmespathjmespath-ruby-

Explore more