Bazel
Monthly
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. No vendor patch available.
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. No vendor patch available.
An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.