Skip to content
Sign in
5.1 Medium

CVE-2022-3474 A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided…

Description

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

Affected products and versions

Product Affected versions Fixed in
Bazel 5.0 5.0.0 → < 5.3.2 5.3.2
Bazel 4.0 4.0.0 → < 4.2.3 4.2.3
Bazel 3.0 3.0.0 → < 3.7.2 3.7.2
bazel 3.0 3.0.0 → < 3.7.2 3.7.2
Track this CVE