medium4.3
CVE-2022-3474
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required…
Impact
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bazel | from 3.1.0 before 4.2.3 from 5.0.0 before 5.3.2 |