Merge pull request #1215 from jasnow/aug-16a-advs

Updated jmespatch advisory with new data

Thanks

Author: jasnow

gems/jmespath/CVE-2022-32511.yml

@@ -2,16 +2,27 @@
 gem: jmespath
 cve: 2022-32511
 ghsa: 5c5f-7vfq-3732
-url: https://github.com/jmespath/jmespath.rb/pull/55
+url: https://nvd.nist.gov/vuln/detail/CVE-2022-32511
 title: JMESPath for Ruby using JSON.load instead of JSON.parse
 date: 2022-06-07
 description: |
   jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a
   situation where JSON.parse is preferable.
+cvss_v2: 7.5
 cvss_v3: 9.8
 patched_versions:
   - ">= 1.6.1"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-32511
+    - https://github.com/jmespath/jmespath.rb/blob/main/CHANGELOG.md#161-2022-03-07
     - https://github.com/jmespath/jmespath.rb/compare/v1.6.0...v1.6.1
+    - https://github.com/jmespath/jmespath.rb/pull/55
+    - https://github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49
     - https://stackoverflow.com/a/30050571/580231
+    - https://github.com/advisories/GHSA-5c5f-7vfq-3732
+notes: |
+  - cvss_v3 from GHSA and nvd.nist.gov
+  - cvss_v2 from nvd.nist.gov
+  - This is under the AWS/Amazon Security policy
+  - Release 1.6.2 (2022-11-25) was last release.