High severityNVD Advisory· Published Jun 30, 2022· Updated Apr 22, 2025
Unsafe YAML deserialization in opensearch-ruby
CVE-2022-31115
Description
opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safe_load. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. An attacker must be in control of an opensearch server and convince the victim to connect to it in order to exploit this vulnerability. The problem has been patched in opensearch-ruby gem version 2.0.1. Users are advised to upgrade. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
opensearch-rubyRubyGems | >= 2.0.0, < 2.0.2 | 2.0.2 |
Affected products
2- Range: < 2.0.1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-977c-63xq-cgw3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-31115ghsaADVISORY
- github.com/opensearch-project/opensearch-ruby/commit/d74a98b45c037671e8819fa87f6a6423458ab08aghsaWEB
- github.com/opensearch-project/opensearch-ruby/compare/v2.0.1...v2.0.2ghsaWEB
- github.com/opensearch-project/opensearch-ruby/pull/77ghsax_refsource_MISCWEB
- github.com/opensearch-project/opensearch-ruby/security/advisories/GHSA-977c-63xq-cgw3ghsax_refsource_CONFIRMWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/opensearch-ruby/CVE-2022-31115.ymlghsaWEB
- staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updatedghsaWEB
- staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.