PT-2022-22308 · Google · Bazel

Meteorcloudy + 1 · Published 2022-10-26 · Updated 2024-05-21 · CVE-2022-3474

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bazel versions prior to 5.3.2 Bazel versions prior to 4.2.3

Description A bad credential handling in the remote assets API sends all user-provided credentials instead of only the required ones for the requests.

Recommendations For Bazel versions prior to 5.3.2, upgrade to version 5.3.2 or later. For Bazel versions prior to 4.2.3, upgrade to version 4.2.3 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

AZL-11350

CVE-2022-3474

GHSA-MXR8-Q875-RHWQ

Affected Products

Bazel

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-3474 · Security Note
• https://osv.dev/vulnerability/AZL-11350 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3474 · Vendor Advisory
• https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq · Note
• https://t.me/cvenotify/80504 · Telegram Post