Is CVE-2022-32511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-32511 being exploited in the wild.

How severe is CVE-2022-32511?

Critical severity, with a CVSS score of 9.8, published 7 June 2022.

Which products and versions are affected?

Jmespath.Rb < 1.6.1; jmespath (RubyGems) ECOSYSTEM:introduced=0,fixed=1.6.1.

Is there a fix for CVE-2022-32511?

Yes. jmespath (RubyGems): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-32511 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-32511?

Check whether you run Jmespath.Rb or jmespath (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-32511: JMESPath for Ruby unsafe deserialization in jmespath.rb

Q: Which products and versions are affected?

Jmespath.Rb < 1.6.1; jmespath (RubyGems) ECOSYSTEM:introduced=0,fixed=1.6.1.

Q: Is there a fix for CVE-2022-32511?

Yes. jmespath (RubyGems): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-32511 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2022-32511?

Check whether you run Jmespath.Rb or jmespath (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-32511 · Severity: critical · CVSS 9.8 · Published 2022-06-07

JMESPath for Ruby, a library used to search and manipulate JSON data, contains a critical security flaw in how it processes information. An attacker could use this vulnerability to execute unauthorized code or take control of an application that uses this library. This could lead to the theft of sensitive customer data or a complete disruption of business operations.

Vendors: RubyGems.

Quick answers

Is CVE-2022-32511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-32511 being exploited in the wild.
How severe is CVE-2022-32511?: Critical severity, with a CVSS score of 9.8, published 7 June 2022.
Which products and versions are affected?: Jmespath.Rb < 1.6.1; jmespath (RubyGems) ECOSYSTEM:introduced=0,fixed=1.6.1.
Is there a fix for CVE-2022-32511?: Yes. jmespath (RubyGems): upgrade to 1.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-32511 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-32511?: Check whether you run Jmespath.Rb or jmespath (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jmespath (RubyGems): upgrade to 1.6.1 or later
```
bundle update jmespath
```

Technical details

JMESPath for Ruby (jmespath.rb) prior to version 1.6.1 utilizes the unsafe Ruby method JSON.load for deserializing data. This constitutes a CWE-502 (Deserialization of Untrusted Data) vulnerability, as JSON.load can be leveraged to instantiate arbitrary Ruby objects, potentially leading to remote code execution (RCE). The vulnerability can be exploited over the network without authentication or user interaction if the application passes untrusted input to the library's parsing functions. The issue was addressed in version 1.6.1 by switching to the safer JSON.parse method.

Affected products

JMESPath jmespath.rb < 1.6.1

Identifiers

CVE-2022-32511
GHSA-5c5f-7vfq-3732

Timeline

2022-06-06: advisory: NVD publication date
2022-06-07: disclosed: GitHub Advisory published
2022-06-07: patched: Version 1.6.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.