jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable. https://stackoverflow.com/a/30050571/580231 https://github.com/jmespath/jmespath.rb/pull/55 https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
Created rubygem-jmespath tracking bugs for this issue: Affects: epel-7 [bug 2094994] Affects: fedora-all [bug 2094995]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.