blackduck-c-cpp@3.0.6
Scanning for c/c++ projects using blackduck and coverity tools
latest version
3.1.0
latest non vulnerable version
first published
5 years ago
latest version published
5 days ago
licenses detected
- [0,)
Direct Vulnerabilities
Known vulnerabilities in the blackduck-c-cpp package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
blackduck-c-cpp is a Scanning for c/c++ projects using blackduck and coverity tools Affected versions of this package are vulnerable to Information Exposure inheriting sensitive environment variables by subprocesses during build capture and signature scanning. An attacker can access confidential API tokens by executing code within the build process, allowing unauthorized retrieval of these tokens from the ambient process environment. This is only exploitable if the API token is supplied through the How to fix Information Exposure? Upgrade | [1.0.17,3.0.7) |
blackduck-c-cpp is a Scanning for c/c++ projects using blackduck and coverity tools Affected versions of this package are vulnerable to Command Injection via the package manager component. An attacker can execute arbitrary operating system commands by creating a file with shell metacharacters in its name within the scanned build directory, which are then interpolated into command strings and executed through a shell without proper quoting or escaping. No control over the build command or tool configuration is required. How to fix Command Injection? Upgrade | [,3.0.7) |