Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Priority MEDIUM 42CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub, Red Hat and Microsoft. Impact type from Microsoft.
Summary
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0118 67th percentileScored 2026-11-07
Fix Fixed Microsoft.Data.SqlClient (NuGet): 2.1.7, 3.1.5, 4.0.5 +1System.Data.SqlClient (NuGet): 4.8.6Red Hat: 7 advisoriesMicrosoft: 19 updates
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft SQL Server 2022 (GDR) | 16.0.0 to before 16.0.1110.1 | 16.0.1110.1 | Patch available | CNA |
| Microsoft | .NET 6.0 | 6.0.0 to before 6.0.26 | 6.0.26 | Patch available | CNA |
| Microsoft | .NET 7.0 | 7.0.0 to before 7.0.15 | 7.0.15 | Patch available | CNA |
| Microsoft | .NET 8.0 | 8.0 to before 8.0.1 | 8.0.1 | Patch available | CNA |
| Microsoft | Microsoft.Data.SqlClient | 2.0 to before 2.1.7 | 2.1.7 | Patch available | CNA |
| Microsoft | Microsoft.Data.SqlClient | 3.0 to before 3.1.5 | 3.1.5 | Patch available | CNA |
| Microsoft | Microsoft.Data.SqlClient | 4.0 to before 4.0.5 | 4.0.5 | Patch available | CNA |
| Microsoft | Microsoft.Data.SqlClient | 5.0 to before 5.1.3 | 5.1.3 | Patch available | CNA |
| Microsoft | System.Data.SqlClient | 1.0 to before 4.8.6 | 4.8.6 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 to before 17.2.23 | 17.2.23 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 to before 17.4.15 | 17.4.15 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.6 | 17.6.0 to before 17.6.11 | 17.6.11 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.8 | 17.8.0 to before 17.8.4 | 17.8.4 | Patch available | CNA |
| Microsoft | Microsoft SQL Server 2022 (CU 10) | before 16.0.4100.1 | 16.0.4100.1 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 to before 4.8.04690.02 | 4.8.04690.02 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 to before 4.8.04690.02 | 4.8.04690.02 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 to before 4.7.04081.03 | 4.7.04081.03 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 to before 4.7.04081.02 | 4.7.04081.02 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | 4.8.1 to before 4.8.09214.01 | 4.8.09214.01 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 | 2.0.0 to before 3.0.50727.8976 | 3.0.50727.8976 | Patch available | CNA |
| — | Microsoft.Data.SqlClient (NuGet) | before 2.1.7 | 2.1.7 | Patch available | GHSA-98g6-xh36-x2p7 |
| — | System.Data.SqlClient (NuGet) | before 4.8.6 | 4.8.6 | Patch available | GHSA-98g6-xh36-x2p7 |
| — | Microsoft.Data.SqlClient (NuGet) | 3.0.0 to before 3.1.5 | 3.1.5 | Patch available | GHSA-98g6-xh36-x2p7 |
| — | Microsoft.Data.SqlClient (NuGet) | 4.0.0 to before 4.0.5 | 4.0.5 | Patch available | GHSA-98g6-xh36-x2p7 |
| — | Microsoft.Data.SqlClient (NuGet) | 5.0.0 to before 5.1.3 | 5.1.3 | Patch available | GHSA-98g6-xh36-x2p7 |
- Microsoft SQL Server 2022 (GDR) VendorMicrosoft Affected 16.0.0 to before 16.0.1110.1 Fixed in 16.0.1110.1 Patch available CNA
- .NET 6.0 VendorMicrosoft Affected 6.0.0 to before 6.0.26 Fixed in 6.0.26 Patch available CNA
- .NET 7.0 VendorMicrosoft Affected 7.0.0 to before 7.0.15 Fixed in 7.0.15 Patch available CNA
- .NET 8.0 VendorMicrosoft Affected 8.0 to before 8.0.1 Fixed in 8.0.1 Patch available CNA
- Microsoft.Data.SqlClient VendorMicrosoft Affected 2.0 to before 2.1.7 Fixed in 2.1.7 Patch available CNA
- Microsoft.Data.SqlClient VendorMicrosoft Affected 3.0 to before 3.1.5 Fixed in 3.1.5 Patch available CNA
- Microsoft.Data.SqlClient VendorMicrosoft Affected 4.0 to before 4.0.5 Fixed in 4.0.5 Patch available CNA
- Microsoft.Data.SqlClient VendorMicrosoft Affected 5.0 to before 5.1.3 Fixed in 5.1.3 Patch available CNA
- System.Data.SqlClient VendorMicrosoft Affected 1.0 to before 4.8.6 Fixed in 4.8.6 Patch available CNA
- Microsoft Visual Studio 2022 version 17.2 VendorMicrosoft Affected 17.2.0 to before 17.2.23 Fixed in 17.2.23 Patch available CNA
- Microsoft Visual Studio 2022 version 17.4 VendorMicrosoft Affected 17.4.0 to before 17.4.15 Fixed in 17.4.15 Patch available CNA
- Microsoft Visual Studio 2022 version 17.6 VendorMicrosoft Affected 17.6.0 to before 17.6.11 Fixed in 17.6.11 Patch available CNA
- Microsoft Visual Studio 2022 version 17.8 VendorMicrosoft Affected 17.8.0 to before 17.8.4 Fixed in 17.8.4 Patch available CNA
- Microsoft SQL Server 2022 (CU 10) VendorMicrosoft Affected before 16.0.4100.1 Fixed in 16.0.4100.1 Patch available CNA
- Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.04690.02 Fixed in 4.8.04690.02 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.04690.02 Fixed in 4.8.04690.02 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.04081.03 Fixed in 4.7.04081.03 Patch available CNA
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.04081.02 Fixed in 4.7.04081.02 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 4.8.09214.01 Fixed in 4.8.09214.01 Patch available CNA
- Microsoft .NET Framework 2.0 Service Pack 2 VendorMicrosoft Affected 2.0.0 to before 3.0.50727.8976 Fixed in 3.0.50727.8976 Patch available CNA
- Microsoft.Data.SqlClient (NuGet) Vendor— Affected before 2.1.7 Fixed in 2.1.7 Patch available GHSA-98g6-xh36-x2p7
- System.Data.SqlClient (NuGet) Vendor— Affected before 4.8.6 Fixed in 4.8.6 Patch available GHSA-98g6-xh36-x2p7
- Microsoft.Data.SqlClient (NuGet) Vendor— Affected 3.0.0 to before 3.1.5 Fixed in 3.1.5 Patch available GHSA-98g6-xh36-x2p7
- Microsoft.Data.SqlClient (NuGet) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-98g6-xh36-x2p7
- Microsoft.Data.SqlClient (NuGet) Vendor— Affected 5.0.0 to before 5.1.3 Fixed in 5.1.3 Patch available GHSA-98g6-xh36-x2p7
CPE configurations NVD · 41
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:* | 2.1 to before 2.1.7; 3.1 to before 3.1.5; 4.0 to before 4.0.5; 5.1 to before 5.1.3 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:* | 2022 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:sql_server:2022:cumulative_update_10:*:*:*:*:*:* | 2022 cumulative_update_10 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:system.data.sqlclient:*:*:*:*:*:*:*:* | before 4.8.6 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.2 to before 17.2.23; 17.4 to before 17.4.15; 17.6 to before 17.6.11; 17.8 to before 17.8.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:* | 4.8 to before 4.8.04690.02 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* | r2 sp1 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:microsoft:microsoft.data.sqlclient:*:*:*:*:*:*:*:* Versions 2.1 to before 2.1.7; 3.1 to before 3.1.5; 4.0 to before 4.0.5; 5.1 to before 5.1.3 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2022:*:*:*:*:*:x64:* Versions 2022 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:sql_server:2022:cumulative_update_10:*:*:*:*:*:* Versions 2022 cumulative_update_10 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:system.data.sqlclient:*:*:*:*:*:*:*:* Versions before 4.8.6 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.2 to before 17.2.23; 17.4 to before 17.4.15; 17.6 to before 17.6.11; 17.8 to before 17.8.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:* Versions 4.8 to before 4.8.04690.02 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Show 31 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:* | 4.8 to before 4.8.04690.01 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* | 4.6.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* | 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* | 4.7.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* | 4.8.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* | 2.0 sp2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.26; 7.0.0 to before 7.0.15 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net:8.0.0:-:*:*:*:*:*:* | 8.0.0 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:* Versions 4.8 to before 4.8.04690.01 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022_23h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.26; 7.0.0 to before 7.0.15 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net:8.0.0:-:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Microsoft
Remediation
- Fix · GHSA-98g6-xh36-x2p7 Microsoft.Data.SqlClient (NuGet) Fixed in 2.1.7 Advisory →
- Fix · GHSA-98g6-xh36-x2p7 System.Data.SqlClient (NuGet) Fixed in 4.8.6 Advisory →
- Fix · GHSA-98g6-xh36-x2p7 Microsoft.Data.SqlClient (NuGet) Fixed in 3.1.5 Advisory →
- Fix · GHSA-98g6-xh36-x2p7 Microsoft.Data.SqlClient (NuGet) Fixed in 4.0.5 Advisory →
- Fix · GHSA-98g6-xh36-x2p7 Microsoft.Data.SqlClient (NuGet) Fixed in 5.1.3 Advisory →
Red Hat 7 advisories
- RHSA-2024:0255 Released 2024-01-15 · Red Hat rating Important.NET 6.0 security, bug fix, and enhancement update
- .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet60-aspnetcore-runtime-6.0-6.0.26-1.el7_9, rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.26-1.el7_9, rh-dotnet60-dotnet-6.0.126-1.el7_9 +9
- .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet60-aspnetcore-runtime-6.0-6.0.26-1.el7_9, rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.26-1.el7_9, rh-dotnet60-dotnet-6.0.126-1.el7_9 +9
- .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet60-aspnetcore-runtime-6.0-6.0.26-1.el7_9, rh-dotnet60-aspnetcore-targeting-pack-6.0-6.0.26-1.el7_9, rh-dotnet60-dotnet-6.0.126-1.el7_9 +9
- RHSA-2024:0157 Released 2024-01-10 · Red Hat rating Important.NET 7.0 security update
- Red Hat CodeReady Linux Builder (v. 8) dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el8_9
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-7.0-7.0.15-1.el8_9, aspnetcore-targeting-pack-7.0-7.0.15-1.el8_9, dotnet-apphost-pack-7.0-7.0.15-1.el8_9 +6
- RHSA-2024:0158 Released 2024-01-10 · Red Hat rating Important.NET 6.0 security update
- Red Hat CodeReady Linux Builder (v. 8) dotnet-sdk-6.0-source-built-artifacts-6.0.126-1.el8_9
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-6.0-6.0.26-1.el8_9, aspnetcore-targeting-pack-6.0-6.0.26-1.el8_9, dotnet-apphost-pack-6.0-6.0.26-1.el8_9 +6
Show 4 more Red Hat advisories
- RHSA-2024:0156 Released 2024-01-10 · Red Hat rating Important.NET 6.0 security update
- Red Hat CodeReady Linux Builder (v. 9) dotnet-sdk-6.0-source-built-artifacts-6.0.126-1.el9_3
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-6.0-6.0.26-1.el9_3, aspnetcore-targeting-pack-6.0-6.0.26-1.el9_3, dotnet-apphost-pack-6.0-6.0.26-1.el9_3 +6
- RHSA-2024:0150 Released 2024-01-10 · Red Hat rating Important.NET 8.0 security update
- Red Hat CodeReady Linux Builder (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.101-1.el8_9
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.1-1.el8_9, aspnetcore-targeting-pack-8.0-8.0.1-1.el8_9, dotnet-8.0.101-1.el8_9 +9
- RHSA-2024:0152 Released 2024-01-10 · Red Hat rating Important.NET 8.0 security update
- Red Hat CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.101-1.el9_3
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.1-1.el9_3, aspnetcore-targeting-pack-8.0-8.0.1-1.el9_3, dotnet-apphost-pack-8.0-8.0.1-1.el9_3 +8
- RHSA-2024:0151 Released 2024-01-10 · Red Hat rating Important.NET 7.0 security update
- Red Hat CodeReady Linux Builder (v. 9) dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el9_3
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-7.0-7.0.15-1.el9_3, aspnetcore-targeting-pack-7.0-7.0.15-1.el9_3, dotnet-apphost-pack-7.0-7.0.15-1.el9_3 +6
Microsoft 19 updates
- Monthly Rollup
- Microsoft .NET Framework 2.0 Service Pack 2 3.0.50727.8976
- Microsoft .NET Framework 3.0 Service Pack 2 3.0.50727.8976
- Microsoft .NET Framework 4.6.2 4.7.04081.03
- Monthly Rollup
- Microsoft .NET Framework 3.5 3.0.50727.8976
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 3.0.50727.8976, 4.7.04081.03
- Microsoft .NET Framework 4.8 4.8.04690.02
- Monthly Rollup
- Microsoft .NET Framework 3.5 3.0.50727.8976
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04081.03
- Microsoft .NET Framework 4.8 4.8.04690.02
Show 16 more Microsoft updates
- Monthly Rollup
- Microsoft .NET Framework 3.5.1 3.0.30729.8959
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04081.03
- Microsoft .NET Framework 4.8 4.8.04690.02
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
- Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 4.7.04081.03
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02, 4.8.09214.01
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
- Security Only
- Microsoft .NET Framework 2.0 Service Pack 2 3.0.50727.8976
- Microsoft .NET Framework 3.0 Service Pack 2 3.0.50727.8976
- Microsoft .NET Framework 4.6.2 4.7.04081.02
- Security Only
- Microsoft .NET Framework 3.5.1 3.0.30729.8959
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04081.02, 4.8.04690.01
- Microsoft .NET Framework 4.8 4.8.04690.01
- Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 10.0.14393.6614
- Windows 10 Version 1607 for 32-bit Systems 10.0.14393.6614
- Windows 10 Version 1607 for x64-based Systems 10.0.14393.6614
- Windows Server 2016 10.0.14393.6614
- Windows Server 2016 (Server Core installation) 10.0.14393.6614
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
- Security Update
- Microsoft .NET Framework 4.8 4.8.04690.02
- Security Update
- .NET 8.0 8.0.1
- Security Update
- .NET 7.0 7.0.15
- Security Update
- .NET 6.0 6.0.26
- Security Update
- Microsoft SQL Server 2022 for x64-based Systems (CU 10) 16.0.4100.1
- Security Update
- Microsoft SQL Server 2022 for x64-based Systems (GDR) 16.0.1110.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2024:0255 |
| .NET Core on Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:0255 |
| .NET Core on Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:0255 |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2024:0150, RHSA-2024:0157, RHSA-2024:0158 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:0151, RHSA-2024:0152, RHSA-2024:0156 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0150, RHSA-2024:0157, RHSA-2024:0158 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0151, RHSA-2024:0152, RHSA-2024:0156 |
Microsoft
Microsoft's page for this CVE →
- Impact
- Security Feature Bypass
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| Microsoft Visual Studio 2022 version 17.2 | Fixed | 17.2.23 · Security Update |
| Microsoft Visual Studio 2022 version 17.4 | Fixed | 17.4.15 · Security Update |
| Microsoft Visual Studio 2022 version 17.6 | Fixed | 17.6.11 · Security Update |
| Microsoft Visual Studio 2022 version 17.8 | Fixed | 17.8.4 · Security Update |
| Microsoft.Data.SqlClient 2.1 | Fixed | 2.1.7 · Security Update |
| Microsoft.Data.SqlClient 3.1 | Fixed | 3.1.5 · Security Update |
| Microsoft.Data.SqlClient 4.0 | Fixed | 4.0.5 · Security Update |
| Microsoft.Data.SqlClient 5.1 | Fixed | 5.1.3 · Security Update |
| System.Data.SqlClient | Fixed | 4.8.6 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0056
- 2026-10-03 Alias added: GHSA-98g6-xh36-x2p7
References
More Microsoft .net vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-0056 · CVE Program
- CVE-2024-0056 · NVD
- FIRST EPSS
- GHSA-98g6-xh36-x2p7 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-0056 · Microsoft Security Update Guide
- CVE-2024-0056 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences