Vulnerabilities in pkg:nuget/System.Data.SqlClient
PACKAGECVE-2024-0056 is a HIGH (CVSS 8.7) microsoft.data.sqlclient and system.data.sqlclient vulnerable to vulnerability (CWE-319: Cleartext Transmission of Sensitive Information) affecting Microsoft.Data.SqlClient libraries in the NuGet ecosystem. The issue involves microsoft.data.sqlclient and system.data.sqlclient vulnerable to sql data provider security feature bypass. Remediation is available by upgrading affected packages to version 2.1.7, 4.8.6, 3.1.5, 4.0.5, 5.1.3.
pkg:nuget/System.Data.SqlClient
Vulnerability advisories affecting package pkg:nuget/System.Data.SqlClient. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-98g6-xh36-x2p7 | CVE-2024-0056 | HIGH | Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass |
| GHSA-8g2p-5pqh-5jmc | CVE-2022-41064 | MODERATE | .NET Information Disclosure Vulnerability |
CVE-2024-0056 at a Glance
Security Impact
CVSS: 8.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
How to Fix CVE-2024-0056
To remediate this vulnerability, upgrade all affected Microsoft.Data.SqlClient dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade Microsoft.Data.SqlClient to 2.1.7Upgrade System.Data.SqlClient to 4.8.6Upgrade Microsoft.Data.SqlClient to 3.1.5Upgrade Microsoft.Data.SqlClient to 4.0.5Upgrade Microsoft.Data.SqlClient to 5.1.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for Microsoft.Data.SqlClientHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-0056, inspect your project dependencies for Microsoft.Data.SqlClient:
inspect dependencies for Microsoft.Data.SqlClientAnalyze the terminal output to locate any version of Microsoft.Data.SqlClient in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.1.7), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-319: Cleartext Transmission of Sensitive Information, where the product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. In Microsoft.Data.SqlClient, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-0056 Affected Microsoft.Data.SqlClient Versions
5 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
Microsoft.Data.SqlClient
|
NuGet |
< 2.1.7
|
2.1.7
|
|
System.Data.SqlClient
|
NuGet |
< 4.8.6
|
4.8.6
|
|
Microsoft.Data.SqlClient
|
NuGet |
≥ 3.0.0
< 3.1.5
|
3.1.5
|
|
Microsoft.Data.SqlClient
|
NuGet |
≥ 4.0.0
< 4.0.5
|
4.0.5
|
|
Microsoft.Data.SqlClient
|
NuGet |
≥ 5.0.0
< 5.1.3
|
5.1.3
|
References
Frequently Asked Questions
What is CVE-2024-0056?
Which Microsoft.Data.SqlClient versions are affected?
What version fixes CVE-2024-0056?
Is Microsoft.Data.SqlClient affected?
Is System.Data.SqlClient affected?
What is the CVSS score of CVE-2024-0056?
What CWE is associated with CVE-2024-0056?
How can I check NuGet dependencies for CVE-2024-0056?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-98g6-xh36-x2p7",
"modified" : "2024-05-31T20:35:56Z",
"published" : "2024-01-09T18:30:27Z",
"aliases" : [ "CVE-2024-0056" ],
"summary" : "Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass ",
"details" : "Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Data.SqlClient"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.1.7"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "System.Data.SqlClient"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.8.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Data.SqlClient"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.1.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Data.SqlClient"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.0.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "NuGet",
"name" : "Microsoft.Data.SqlClient"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0"
}, {
"fixed" : "5.1.3"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-0056"
}, {
"type" : "WEB",
"url" : "https://github.com/dotnet/announcements/issues/292"
}, {
"type" : "WEB",
"url" : "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-319" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2024-01-16T19:13:48Z",
"nvd_published_at" : "2024-01-09T18:15:46Z"
}
}