PT-2022-5635 · Microsoft · System.Data.Sqlclient+3

Published 2022-11-08 · Updated 2025-01-02 · CVE-2022-41064

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions .NET Framework versions prior to the November 2022 update System.Data.SqlClient versions prior to 4.8.5 Microsoft.Data.SqlClient versions prior to 2.1.2

Description A vulnerability in .NET Framework allows attackers to obtain sensitive information and affect the system. The issue is related to the System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages, where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query. If you are not talking to Microsoft SQL Server from your application, you are not affected by this vulnerability.

Recommendations For .NET Framework, install the November 2022 update. For System.Data.SqlClient on .NET Core, .NET 5, or .NET 6, update the NuGet package to version 4.8.5 or later. For Microsoft.Data.SqlClient, update the NuGet package to version 2.1.2 or later. To fix direct dependencies, edit the project file or use the NuGet command line to update the dependency. To fix transitive dependencies, discover them by examining the project.assets.json file, and then add a direct dependency to the updated package to your csproj file to override the transitive dependency. Rebuild your application, test, and redeploy after updating the dependencies.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-07003

CVE-2022-41064

GHSA-8G2P-5PQH-5JMC

Affected Products

.Net Framework

Sql Server

Microsoft.Data.Sqlclient

System.Data.Sqlclient

References · 14

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41064 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g2p-5pqh-5jmc · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41064 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41064 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41064 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41064 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07003 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41064 · Security Note
• https://github.com/dotnet/corefx · Note
• https://github.com/dotnet/corefx/security/advisories/GHSA-8g2p-5pqh-5jmc · Note
• https://github.com/dotnet/runtime/issues/78042 · Note
• https://t.me/cvenotify/54071 · Telegram Post
• https://nuget.org/packages/Microsoft.Data.SqlClient · Note
• https://t.me/cibsecurity/52730 · Telegram Post