CVE-2022-29218

RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.

• CWE-269
• CWE-290
• CWE-863

• https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8wExploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220629-0010/Third Party Advisory
• https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8wExploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220629-0010/Third Party Advisory

Published

May 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29212TensorFlow is an open source platform for machine learning. …5.5
• CVE-2022-29213TensorFlow is an open source platform for machine learning. …5.5
• CVE-2022-29214NextAuth.js (next-auth) is am open source authentication sol…6.1
• CVE-2022-29215RegionProtect is a plugin that allows users to manage certai…7.5
• CVE-2022-29216TensorFlow is an open source platform for machine learning. …7.8
• CVE-2022-29217PyJWT is a Python implementation of RFC 7519. PyJWT supports…7.5
• CVE-2022-29219Lodestar is a TypeScript implementation of the Ethereum Cons…7.5
• CVE-2022-2922Relative Path Traversal in GitHub repository dnnsoftware/dnn…4.9
• CVE-2022-29220github-action-merge-dependabot is an action that automatical…6.5
• CVE-2022-29221Smarty is a template engine for PHP, facilitating the separa…8.8
• CVE-2022-29222Pion DTLS is a Go implementation of Datagram Transport Layer…7.5
• CVE-2022-29223Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8