CVE-2022-41064

.NET Framework Information Disclosure Vulnerability

.NET Framework Information Disclosure Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages.

A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query.

<a name="mitigation-factors"></a>Mitigation factors

If you are not talking to Microsoft SQL Server from your application you are not affected by this vulnerability.

<a name="how-affected"></a>How do I know if I am affected?

.NET has two types of dependencies: direct and transitive. Direct dependencies are dependencies where you specifically add a package to your project, transitive dependencies occur when you add a package to your project that in turn relies on another package.

For example, the Microsoft.AspNetCore.Mvc package depends on the Microsoft.AspNetCore.Mvc.Core package. When you add a dependency on Microsoft.AspNetCore.Mvc in your project, you're taking a transitive dependency on Microsoft.AspNetCore.Mvc.Core.

Any application that has a direct or transitive dependency on the  affected packages listed above are vulnerable.

<a name="how-fix"></a>How do I fix the issue?

• If you are using System.Data.SqlClient on .NET Framework you must install the November update for .NET Framework
• If you are using System.Data.SqlClient on .NET Core, .NET 5 or .NET 6 you must update the nuget package to an updated version as listed in the affected packages.
• If you are using Microsoft.Data.SqlClient, anywhere (.NET Core, .NET 5/6, .NET Framework) and you are using a version that is vulnerable you must update as listed in the affected packages.

Additional Details

.NET and .NET Framework projects have two types of dependencies: direct and transitive. You must update your projects using the following instructions to address both types of dependency.

Additionally, .NET Framework users must also install the November 2022 security patch to be protected.

Direct dependencies

Direct dependencies are discoverable by examining your csproj file. They can be fixed by editing the project file or using nuget command line to update the dependency.

Transitive dependencies

Transitive dependencies occur when you add a package to your project that in turn relies on another package. Transitive dependencies can be discovered by searching the project.assets.json file for each of your projects. This file is produced on each build and is in the obj directory for each project.

The project.assets.json files are the authoritative list of all packages used by your project, containing both direct and transitive dependencies.

Fixing direct dependencies

Direct dependencies are nuget packages that have been specifically added to a project, rather than being pulled in because a nuget package added requires it. They can be seen in the solution explorer in Visual Studio or by opening the csproj for the project and examining the packageReference nodes for the package name, specified by the Include parameter, and its version, specified by the Version parameter.

For example, the following project file has a direct dependency on version 2.1.1 of Microsoft.Data.SqlClient.

<Project Sdk="Microsoft.NET.Sdk.Web"> 

  <PropertyGroup> 
    <TargetFramework>net6.0</TargetFramework> 
    <Nullable>enable</Nullable> 
    <ImplicitUsings>enable</ImplicitUsings> 
  </PropertyGroup> 

  <ItemGroup> 
    <PackageReference Include="Microsoft.Data.SqlClient" Version="2.1.1" /> 
  </ItemGroup> 

</Project> 

Fixing direct dependencies with the nuget command line

Open a command line to the directory holding your project

Run the following command if you are using a version of Microsoft.Data.SqlClient between 2.0.0 and 2.1.1

dotnet add package Microsoft.Data.SqlClient…

.NET Framework Information Disclosure Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages.

A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query.

<a name="mitigation-factors"></a>Mitigation factors

If you are not talking to Microsoft SQL Server from your application you are not affected by this vulnerability.

<a name="how-affected"></a>How do I know if I am affected?

.NET has two types of dependencies: direct and transitive. Direct dependencies are dependencies where you specifically add a package to your project, transitive dependencies occur when you add a package to your project that in turn relies on another package.

For example, the Microsoft.AspNetCore.Mvc package depends on the Microsoft.AspNetCore.Mvc.Core package. When you add a dependency on Microsoft.AspNetCore.Mvc in your project, you're taking a transitive dependency on Microsoft.AspNetCore.Mvc.Core.

Any application that has a direct or transitive dependency on the  affected packages listed above are vulnerable.

<a name="how-fix"></a>How do I fix the issue?

• If you are using System.Data.SqlClient on .NET Framework you must install the November update for .NET Framework
• If you are using System.Data.SqlClient on .NET Core, .NET 5 or .NET 6 you must update the nuget package to an updated version as listed in the affected packages.
• If you are using Microsoft.Data.SqlClient, anywhere (.NET Core, .NET 5/6, .NET Framework) and you are using a version that is vulnerable you must update as listed in the affected packages.

Additional Details

.NET and .NET Framework projects have two types of dependencies: direct and transitive. You must update your projects using the following instructions to address both types of dependency.

Additionally, .NET Framework users must also install the November 2022 security patch to be protected.

Direct dependencies

Direct dependencies are discoverable by examining your csproj file. They can be fixed by editing the project file or using nuget command line to update the dependency.

Transitive dependencies

Transitive dependencies occur when you add a package to your project that in turn relies on another package. Transitive dependencies can be discovered by searching the project.assets.json file for each of your projects. This file is produced on each build and is in the obj directory for each project.

The project.assets.json files are the authoritative list of all packages used by your project, containing both direct and transitive dependencies.

Fixing direct dependencies

Direct dependencies are nuget packages that have been specifically added to a project, rather than being pulled in because a nuget package added requires it. They can be seen in the solution explorer in Visual Studio or by opening the csproj for the project and examining the packageReference nodes for the package name, specified by the Include parameter, and its version, specified by the Version parameter.

For example, the following project file has a direct dependency on version 2.1.1 of Microsoft.Data.SqlClient.

<Project Sdk="Microsoft.NET.Sdk.Web"> 

  <PropertyGroup> 
    <TargetFramework>net6.0</TargetFramework> 
    <Nullable>enable</Nullable> 
    <ImplicitUsings>enable</ImplicitUsings> 
  </PropertyGroup> 

  <ItemGroup> 
    <PackageReference Include="Microsoft.Data.SqlClient" Version="2.1.1" /> 
  </ItemGroup> 

</Project> 

Fixing direct dependencies with the nuget command line

Open a command line to the directory holding your project

Run the following command if you are using a version of Microsoft.Data.SqlClient between 2.0.0 and 2.1.1

dotnet add package Microsoft.Data.SqlClient…