Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Weakness
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Microsoft.data.sqlclient | Microsoft | 2.1 (including) | 2.1.7 (excluding) |
| Microsoft.data.sqlclient | Microsoft | 3.1 (including) | 3.1.5 (excluding) |
| Microsoft.data.sqlclient | Microsoft | 4.0 (including) | 4.0.5 (excluding) |
| Microsoft.data.sqlclient | Microsoft | 5.1 (including) | 5.1.3 (excluding) |
| Sql_server | Microsoft | 2022 (including) | 2022 (including) |
| Sql_server | Microsoft | 2022-cumulative_update_10 (including) | 2022-cumulative_update_10 (including) |
| System.data.sqlclient | Microsoft | * | 4.8.6 (excluding) |
| Visual_studio_2022 | Microsoft | 17.2 (including) | 17.2.23 (excluding) |
| Visual_studio_2022 | Microsoft | 17.4 (including) | 17.4.15 (excluding) |
| Visual_studio_2022 | Microsoft | 17.6 (including) | 17.6.11 (excluding) |
| Visual_studio_2022 | Microsoft | 17.8 (including) | 17.8.4 (excluding) |
| .NET Core on Red Hat Enterprise Linux | RedHat | rh-dotnet60-dotnet-0:6.0.126-1.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet8.0-0:8.0.101-1.el8_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet7.0-0:7.0.115-1.el8_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | dotnet6.0-0:6.0.126-1.el8_9 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet7.0-0:7.0.115-1.el9_3 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet8.0-0:8.0.101-1.el9_3 | * |
| Red Hat Enterprise Linux 9 | RedHat | dotnet6.0-0:6.0.126-1.el9_3 | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/102.html
- https://cwe.mitre.org/data/definitions/117.html
- https://cwe.mitre.org/data/definitions/383.html
- https://cwe.mitre.org/data/definitions/477.html
- https://cwe.mitre.org/data/definitions/65.html