| Package | Affected versions | Patched versions |
|---|---|---|
| bazel | ≥ 3.1.0, < 4.2.3≥ 5.0.0, < 5.3.2 | 4.2.35.3.2 |
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free