GitHub Advisoryadvisory · NuGet

GHSA-98g6-xh36-x2p7 Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

HIGH Published 2024-01-09 Modified 2024-05-31 Official page ↗
Aliases
CVE-2024-0056
Ecosystem
NuGet
Packages
Microsoft.Data.SqlClient, System.Data.SqlClient
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-319
Reviewed
2024-01-16

Affected packages

• NuGet Microsoft.Data.SqlClient: < 2.1.7 → fixed in 2.1.7 • NuGet System.Data.SqlClient: < 4.8.6 → fixed in 4.8.6 • NuGet Microsoft.Data.SqlClient: >= 3.0.0, < 3.1.5 → fixed in 3.1.5 • NuGet Microsoft.Data.SqlClient: >= 4.0.0, < 4.0.5 → fixed in 4.0.5 • NuGet Microsoft.Data.SqlClient: >= 5.0.0, < 5.1.3 → fixed in 5.1.3

Description

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Related

Alias · CVE (1)

  • CVE-2024-0056 Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References