Homepage
About Snyk

bigflow@1.4.0 vulnerabilities

BigQuery client wrapper with clean API

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the bigflow package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Certificate Validation

bigflow is a BigQuery client wrapper with clean API

Affected versions of this package are vulnerable to Improper Certificate Validation such that the get_vault_token function is sending the X-Vault-Token header with the vault secret to the vault endpoint without verifying the server certificate. This allows any Man in the Middle attacker to read the vault secret and gain access to the vault.

How to fix Improper Certificate Validation?

Upgrade bigflow to version 1.6.0 or higher.

[,1.6.0)
Go back to all versions of this package