bazel Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/bazel/ Thu, 23 Feb 2023 14:07:20 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png bazel Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/bazel/ 32 32 CVE-2021-22539 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22539/ Thu, 23 Feb 2023 14:07:20 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22539/ An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 […]

The post CVE-2021-22539 appeared first on CVE Vulnerability.

]]> An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel allows the workspace path to lint *.bzl files to be set via this config file. As such the attacker is able to execute any executable on the system through vscode-bazel. We recommend upgrading to version 0.4.1 or above.

The post CVE-2021-22539 appeared first on CVE Vulnerability.

]]> CVE-2022-3474 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-3474/ Thu, 23 Feb 2023 05:19:30 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-3474/ A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

The post CVE-2022-3474 appeared first on CVE Vulnerability.

]]> A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

The post CVE-2022-3474 appeared first on CVE Vulnerability.

]]>