CVE-2022-3474
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
- Score
- CVSS 4.0 5.1 Medium
- Status
- Modified - cve-coordination@google.com
- Published
- 2022-10-26
- Last modified
- 2024-08-03
- Weaknesses
- CWE-522
Affected products
References
- https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq
