Unauthorized gem takeover for some gems

12/05/2022
733

Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so.To be vulnerable, a gem needed:one or more dashes in its namean attacker-controlled gem with the name before the dashcreation within 30 days OR no updates for over 100 daysFor example, the gem something-provider could have been taken over by the owner of the gem something. Organizations with many gems were not vulnerable as long as they owned the gem with the name before the dash, for example owning the gem orgname protected all gems with names like orgname-provider.
Unauthorized gem takeover for some gems #ruby #rubydeveloper #rubyonrails #gem https://rubyonrails.ba/single/unauthorized-gem-takeover-for-some-gems