Vulnerability · Published Jan 9, 2024 · Assigned by microsoft
CVE-2024-0056Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
High 8.7
In plain English
A high-severity security flaw in Microsoft.Data.SqlClient from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)1.2%top 32.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aspnetcore-runtime-6.0 | 6.0.26-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | aspnetcore-runtime-6.0 | 6.0.26-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | aspnetcore-runtime-7.0 | 7.0.15-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | aspnetcore-runtime-7.0 | 7.0.15-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | aspnetcore-runtime-8.0 | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | aspnetcore-runtime-8.0 | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | aspnetcore-targeting-pack-6.0 | 6.0.26-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | aspnetcore-targeting-pack-7.0 | 7.0.15-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | aspnetcore-targeting-pack-7.0 | 7.0.15-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | aspnetcore-targeting-pack-8.0 | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | aspnetcore-targeting-pack-8.0 | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet | 8.0.101-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:8 | dotnet-apphost-pack-6.0 | 6.0.26-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-apphost-pack-6.0 | 6.0.26-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-apphost-pack-7.0 | 7.0.15-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-apphost-pack-7.0 | 7.0.15-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-apphost-pack-8.0 | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-apphost-pack-8.0 | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-host | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-host | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-hostfxr-6.0 | 6.0.26-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-hostfxr-6.0 | 6.0.26-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-hostfxr-7.0 | 7.0.15-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-hostfxr-7.0 | 7.0.15-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-hostfxr-8.0 | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-hostfxr-8.0 | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-runtime-6.0 | 6.0.26-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-runtime-6.0 | 6.0.26-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-runtime-7.0 | 7.0.15-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-runtime-7.0 | 7.0.15-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-runtime-8.0 | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-runtime-8.0 | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-sdk-6.0 | 6.0.126-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-sdk-6.0 | 6.0.126-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-sdk-6.0-source-built-artifacts | 6.0.126-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-sdk-7.0 | 7.0.115-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-sdk-7.0 | 7.0.115-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-sdk-7.0-source-built-artifacts | 7.0.115-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-sdk-7.0-source-built-artifacts | 7.0.115-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-sdk-8.0 | 8.0.101-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-sdk-8.0 | 8.0.101-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-sdk-8.0-source-built-artifacts | 8.0.101-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-sdk-8.0-source-built-artifacts | 8.0.101-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-targeting-pack-6.0 | 6.0.26-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-targeting-pack-6.0 | 6.0.26-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-targeting-pack-7.0 | 7.0.15-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-targeting-pack-7.0 | 7.0.15-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-targeting-pack-8.0 | 8.0.1-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-targeting-pack-8.0 | 8.0.1-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | dotnet-templates-6.0 | 6.0.126-1.el8_9 | ALSA-2024:0158 |
| AlmaLinux:9 | dotnet-templates-6.0 | 6.0.126-1.el9_3 | ALSA-2024:0156 |
| AlmaLinux:8 | dotnet-templates-7.0 | 7.0.115-1.el8_9 | ALSA-2024:0157 |
| AlmaLinux:9 | dotnet-templates-7.0 | 7.0.115-1.el9_3 | ALSA-2024:0151 |
| AlmaLinux:8 | dotnet-templates-8.0 | 8.0.101-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | dotnet-templates-8.0 | 8.0.101-1.el9_3 | ALSA-2024:0152 |
| AlmaLinux:8 | netstandard-targeting-pack-2.1 | 8.0.101-1.el8_9 | ALSA-2024:0150 |
| AlmaLinux:9 | netstandard-targeting-pack-2.1 | 8.0.101-1.el9_3 | ALSA-2024:0152 |
| Alpine:v3.20 | dotnet6-build | 6.0.126-r0 | ALPINE-CVE-2024-0056 |
| Alpine:v3.20 | dotnet6-runtime | 6.0.26-r0 | ALPINE-CVE-2024-0056 |
| NuGet | microsoft.data.sqlclient | 5.1.3 | GHSA-98g6-xh36-x2p7 |
| NuGet | microsoft.data.sqlclient | 2.1.7 | GHSA-98g6-xh36-x2p7 |
| NuGet | microsoft.data.sqlclient | 3.1.5 | GHSA-98g6-xh36-x2p7 |
| NuGet | microsoft.data.sqlclient | 4.0.5 | GHSA-98g6-xh36-x2p7 |
| NuGet | system.data.sqlclient | 4.8.6 | GHSA-98g6-xh36-x2p7 |
| Rocky Linux:8 | dotnet6.0 | 0:6.0.126-1.el8_9 | RLSA-2024:0158 |
| Rocky Linux:8 | dotnet7.0 | 0:7.0.115-1.el8_9 | RLSA-2024:0157 |
| Rocky Linux:8 | dotnet8.0 | 0:8.0.101-1.el8_9 | RLSA-2024:0150 |
Affected products (as reported)
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C