Vulnerability in RubyGems.org allows substitution of foreign packages
A critical vulnerability (CVE-2022-29176) has been discovered in the RubyGems.org package repository that allows unauthorized substitution of certain foreign packages in the repository by initiating the withdrawal (yank) of a legitimate package and uploading a different file with the same name and version number in its place. Three conditions must be met for successful exploitation: the attack can only be performed on packages with names […]
