CVE-2024-0056

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

8.7 HighFix available

CVE-2024-0056 is a high vulnerability (CVSS 8.7) in Microsoft Microsoft.data.sqlclient, published January 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 68th percentile. Fixed in Microsoft.Data.SqlClient 2.1.7.

What does this mean?

Severity: 8.7 HighCVSS 3.1, CVE List
Exploit chance: 1.18%EPSS, 68th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.1.7Microsoft.Data.SqlClient +233 more

Description

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.18%Up 1.0 points since Jan 18, 2024

Affected products

Show 9 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`Microsoft.Data.SqlClient` NuGet	before 2.1.7	2.1.7
`System.Data.SqlClient` NuGet	before 4.8.6	4.8.6
`Microsoft.Data.SqlClient` NuGet	3.0.0 up to 3.1.5	3.1.5
`Microsoft.Data.SqlClient` NuGet	4.0.0 up to 4.0.5	4.0.5
`Microsoft.Data.SqlClient` NuGet	5.0.0 up to 5.1.3	5.1.3
`dotnet6-build` Alpine:v3.19	before 6.0.126-r0	6.0.126-r0
`dotnet6-build` Alpine:v3.20	before 6.0.126-r0	6.0.126-r0
`dotnet6-runtime` Alpine:v3.19	before 6.0.26-r0	6.0.26-r0
`dotnet6-runtime` Alpine:v3.20	before 6.0.26-r0	6.0.26-r0
`dotnet7-build` Alpine:v3.19	before 7.0.115-r0	7.0.115-r0

Show 224 moreShow less

Affected packages
Package	Affected	Fixed
`dotnet7-runtime` Alpine:v3.19	before 7.0.15-r0	7.0.15-r0
`aspnetcore-runtime-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`aspnetcore-targeting-pack-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`dotnet` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.101-1.el8_9	8.0.101-1.el8_9
`dotnet-apphost-pack-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`dotnet-host` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`dotnet-hostfxr-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`dotnet-runtime-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`dotnet-sdk-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.101-1.el8_9	8.0.101-1.el8_9
`dotnet-sdk-8.0-source-built-artifacts` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.101-1.el8_9	8.0.101-1.el8_9
`dotnet-targeting-pack-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.1-1.el8_9	8.0.1-1.el8_9
`dotnet-templates-8.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.101-1.el8_9	8.0.101-1.el8_9
`netstandard-targeting-pack-2.1` AlmaLinux:8 From an advisory covering 3 CVEs	before 8.0.101-1.el8_9	8.0.101-1.el8_9
`aspnetcore-runtime-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.15-1.el9_3	7.0.15-1.el9_3
`aspnetcore-targeting-pack-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.15-1.el9_3	7.0.15-1.el9_3
`dotnet-apphost-pack-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.15-1.el9_3	7.0.15-1.el9_3
`dotnet-hostfxr-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.15-1.el9_3	7.0.15-1.el9_3
`dotnet-runtime-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.15-1.el9_3	7.0.15-1.el9_3
`dotnet-sdk-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.115-1.el9_3	7.0.115-1.el9_3
`dotnet-sdk-7.0-source-built-artifacts` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.115-1.el9_3	7.0.115-1.el9_3
`dotnet-targeting-pack-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.15-1.el9_3	7.0.15-1.el9_3
`dotnet-templates-7.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 7.0.115-1.el9_3	7.0.115-1.el9_3
`aspnetcore-runtime-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`aspnetcore-targeting-pack-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`dotnet-apphost-pack-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`dotnet-host` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`dotnet-hostfxr-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`dotnet-runtime-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`dotnet-sdk-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.101-1.el9_3	8.0.101-1.el9_3
`dotnet-sdk-8.0-source-built-artifacts` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.101-1.el9_3	8.0.101-1.el9_3
`dotnet-targeting-pack-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.1-1.el9_3	8.0.1-1.el9_3
`dotnet-templates-8.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.101-1.el9_3	8.0.101-1.el9_3
`netstandard-targeting-pack-2.1` AlmaLinux:9 From an advisory covering 3 CVEs	before 8.0.101-1.el9_3	8.0.101-1.el9_3
`aspnetcore-runtime-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.26-1.el9_3	6.0.26-1.el9_3
`aspnetcore-targeting-pack-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.26-1.el9_3	6.0.26-1.el9_3
`dotnet-apphost-pack-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.26-1.el9_3	6.0.26-1.el9_3
`dotnet-hostfxr-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.26-1.el9_3	6.0.26-1.el9_3
`dotnet-runtime-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.26-1.el9_3	6.0.26-1.el9_3
`dotnet-sdk-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.126-1.el9_3	6.0.126-1.el9_3
`dotnet-sdk-6.0-source-built-artifacts` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.126-1.el9_3	6.0.126-1.el9_3
`dotnet-targeting-pack-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.26-1.el9_3	6.0.26-1.el9_3
`dotnet-templates-6.0` AlmaLinux:9 From an advisory covering 3 CVEs	before 6.0.126-1.el9_3	6.0.126-1.el9_3
`aspnetcore-runtime-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.15-1.el8_9	7.0.15-1.el8_9
`aspnetcore-targeting-pack-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.15-1.el8_9	7.0.15-1.el8_9
`dotnet-apphost-pack-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.15-1.el8_9	7.0.15-1.el8_9
`dotnet-hostfxr-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.15-1.el8_9	7.0.15-1.el8_9
`dotnet-runtime-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.15-1.el8_9	7.0.15-1.el8_9
`dotnet-sdk-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.115-1.el8_9	7.0.115-1.el8_9
`dotnet-sdk-7.0-source-built-artifacts` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.115-1.el8_9	7.0.115-1.el8_9
`dotnet-targeting-pack-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.15-1.el8_9	7.0.15-1.el8_9
`dotnet-templates-7.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 7.0.115-1.el8_9	7.0.115-1.el8_9
`aspnetcore-runtime-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.26-1.el8_9	6.0.26-1.el8_9
`aspnetcore-targeting-pack-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.26-1.el8_9	6.0.26-1.el8_9
`dotnet-apphost-pack-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.26-1.el8_9	6.0.26-1.el8_9
`dotnet-hostfxr-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.26-1.el8_9	6.0.26-1.el8_9
`dotnet-runtime-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.26-1.el8_9	6.0.26-1.el8_9
`dotnet-sdk-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.126-1.el8_9	6.0.126-1.el8_9
`dotnet-sdk-6.0-source-built-artifacts` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.126-1.el8_9	6.0.126-1.el8_9
`dotnet-targeting-pack-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.26-1.el8_9	6.0.26-1.el8_9
`dotnet-templates-6.0` AlmaLinux:8 From an advisory covering 3 CVEs	before 6.0.126-1.el8_9	6.0.126-1.el8_9
`dotnet` Bitnami	6.0.0 up to 6.0.26, 7.0.0 up to 7.0.15, 8.0.0 up to 8.0.1	6.0.267.0.158.0.1
`dotnet-sdk` Bitnami	6.0.0 up to 6.0.26, 7.0.0 up to 7.0.15, 8.0.0 up to 8.0.1	6.0.267.0.158.0.1
`Microsoft.Data.SqlClient` NuGet	before 2.1.7, plus listed versions 1.0.19123.2-Preview1.0.19128.1-Preview1.0.19189.1-Preview1.0.19221.1-Preview1.0.19239.1 Show 16 moreShow less 1.0.19249.11.0.19269.11.1.01.1.11.1.21.1.31.1.42.0.02.0.12.1.02.1.12.1.22.1.32.1.42.1.52.1.6	2.1.7
`System.Data.SqlClient` NuGet	before 4.8.6, plus listed versions 1.0.0-beta11.0.0-beta24.0.0-beta-226054.0.0-beta-228164.0.0-beta-23019 Show 33 moreShow less 4.0.0-beta-231094.0.0-beta-231234.0.0-beta-232254.0.0-beta-234094.0.0-beta-235164.1.04.1.0-rc2-240274.3.04.3.0-preview1-24530-044.3.14.4.04.4.0-preview1-25305-024.4.0-preview2-25405-014.4.14.4.24.4.34.5.04.5.0-preview1-26216-024.5.0-preview2-26406-044.5.0-rc14.5.14.5.34.6.04.6.0-preview2-26905-024.6.0-preview3-27014-024.6.14.7.04.8.04.8.14.8.24.8.34.8.44.8.5	4.8.6
`Microsoft.Data.SqlClient` NuGet	3.0.0 up to 3.1.5, plus listed versions 3.0.13.1.03.1.13.1.23.1.33.1.4	3.1.5
`Microsoft.Data.SqlClient` NuGet	4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.24.0.34.0.4	4.0.5
`Microsoft.Data.SqlClient` NuGet	5.0.0 up to 5.1.3, plus listed versions 5.0.15.0.25.1.05.1.15.1.2	5.1.3
`aspnetcore-runtime-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`aspnetcore-targeting-pack-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet-apphost-pack-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-host` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-hostfxr-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-runtime-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-sdk-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet-targeting-pack-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-templates-8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet8.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet8.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet8.0-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-host-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el8_9	0:8.0.1-1.el8_9
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet-sdk-8.0-source-built-artifacts` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet8.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet8.0-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`aspnetcore-runtime-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`aspnetcore-targeting-pack-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-apphost-pack-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-apphost-pack-7.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-hostfxr-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-hostfxr-7.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-runtime-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-runtime-7.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-sdk-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet-sdk-7.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet-targeting-pack-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-templates-7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet7.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet7.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet7.0-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet-apphost-pack-7.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-hostfxr-7.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-runtime-7.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.15-1.el9_3	0:7.0.15-1.el9_3
`dotnet-sdk-7.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet-sdk-7.0-source-built-artifacts` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet7.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`dotnet7.0-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el9_3	0:7.0.115-1.el9_3
`aspnetcore-runtime-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`aspnetcore-targeting-pack-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-apphost-pack-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-host` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-host-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-hostfxr-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-runtime-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-sdk-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet-targeting-pack-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-templates-8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet8.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet8.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet8.0-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`netstandard-targeting-pack-2.1` Red Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet-apphost-pack-8.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-host-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-hostfxr-8.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-runtime-8.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.1-1.el9_3	0:8.0.1-1.el9_3
`dotnet-sdk-8.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet-sdk-8.0-source-built-artifacts` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet8.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`dotnet8.0-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 3 CVEs	before 0:8.0.101-1.el9_3	0:8.0.101-1.el9_3
`aspnetcore-runtime-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`aspnetcore-targeting-pack-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-apphost-pack-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-apphost-pack-6.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-hostfxr-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-hostfxr-6.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-runtime-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-runtime-6.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-sdk-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet-sdk-6.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet-targeting-pack-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-templates-6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet6.0` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet6.0-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet6.0-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet-apphost-pack-6.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-hostfxr-6.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-runtime-6.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.26-1.el9_3	0:6.0.26-1.el9_3
`dotnet-sdk-6.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet-sdk-6.0-source-built-artifacts` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet6.0-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`dotnet6.0-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el9_3	0:6.0.126-1.el9_3
`aspnetcore-runtime-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`aspnetcore-targeting-pack-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-apphost-pack-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-apphost-pack-7.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-hostfxr-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-hostfxr-7.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-runtime-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-runtime-7.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-sdk-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet-sdk-7.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet-targeting-pack-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-templates-7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet7.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet7.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet7.0-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet-apphost-pack-7.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-hostfxr-7.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-runtime-7.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.15-1.el8_9	0:7.0.15-1.el8_9
`dotnet-sdk-7.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet-sdk-7.0-source-built-artifacts` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet7.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet7.0-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`aspnetcore-runtime-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`aspnetcore-targeting-pack-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-apphost-pack-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-apphost-pack-6.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-hostfxr-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-hostfxr-6.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-runtime-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-runtime-6.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-sdk-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet-sdk-6.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet-targeting-pack-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-templates-6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet6.0` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet6.0-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet6.0-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet-apphost-pack-6.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-hostfxr-6.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-runtime-6.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.26-1.el8_9	0:6.0.26-1.el8_9
`dotnet-sdk-6.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet-sdk-6.0-source-built-artifacts` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet6.0-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`dotnet6.0-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 4 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9
`rh-dotnet60-aspnetcore-runtime-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-aspnetcore-targeting-pack-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-dotnet` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.126-1.el7_9	0:6.0.126-1.el7_9
`rh-dotnet60-dotnet-apphost-pack-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-dotnet-debuginfo` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.126-1.el7_9	0:6.0.126-1.el7_9
`rh-dotnet60-dotnet-host` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-dotnet-hostfxr-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-dotnet-runtime-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-dotnet-sdk-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.126-1.el7_9	0:6.0.126-1.el7_9
`rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.126-1.el7_9	0:6.0.126-1.el7_9
`rh-dotnet60-dotnet-targeting-pack-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.26-1.el7_9	0:6.0.26-1.el7_9
`rh-dotnet60-dotnet-templates-6.0` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.126-1.el7_9	0:6.0.126-1.el7_9
`rh-dotnet60-netstandard-targeting-pack-2.1` Red Hat:rhel_dotnet:6.0::el7 From an advisory covering 3 CVEs	before 0:6.0.126-1.el7_9	0:6.0.126-1.el7_9
`dotnet8.0` Rocky Linux:8 From an advisory covering 3 CVEs	before 0:8.0.101-1.el8_9	0:8.0.101-1.el8_9
`dotnet7.0` Rocky Linux:8 From an advisory covering 3 CVEs	before 0:7.0.115-1.el8_9	0:7.0.115-1.el8_9
`dotnet6.0` Rocky Linux:8 From an advisory covering 3 CVEs	before 0:6.0.126-1.el8_9	0:6.0.126-1.el8_9

What each source reports

CVE List Score used8.7

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: CVE-2024-0056
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Weakness: CWE-319
Updated: 2026-11-02

EUVDEUVD-2024-03118.7

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: EUVD-2024-0311
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-98g6-xh36-x2p78.7

Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: GHSA-98g6-xh36-x2p7
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-319
Updated: 2026-11-02

NVD8.7

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: CVE-2024-0056
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-319
Updated: 2026-11-02

OSVALPINE-CVE-2024-00568.7

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: ALPINE-CVE-2024-0056
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-03

OSV8.7

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: CVE-2024-0056
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

Show 19 moreShow less

OSVGHSA-98g6-xh36-x2p78.7

Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: GHSA-98g6-xh36-x2p7
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-319
Updated: 2026-11-02

OSVRHSA-2024:01509.8

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2024:0150
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:01519.8

Red Hat Security Advisory: .NET 7.0 security update

Record: RHSA-2024:0151
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:01529.8

Red Hat Security Advisory: .NET 8.0 security update

Record: RHSA-2024:0152
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:01569.8

Red Hat Security Advisory: .NET 6.0 security update

Record: RHSA-2024:0156
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:01579.8

Red Hat Security Advisory: .NET 7.0 security update

Record: RHSA-2024:0157
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:01589.8

Red Hat Security Advisory: .NET 6.0 security update

Record: RHSA-2024:0158
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:02559.8

Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

Record: RHSA-2024:0255
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2024:0150No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0150
Updated: 2026-11-02

OSVALSA-2024:0151No score

Important: .NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0151
Updated: 2026-11-02

OSVALSA-2024:0152No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0152
Updated: 2026-11-02

OSVALSA-2024:0156No score

Important: .NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.126 and .NET Runtime 6.0.26.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0156
Updated: 2026-11-02

OSVALSA-2024:0157No score

Important: .NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0157
Updated: 2026-11-02

OSVALSA-2024:0158No score

Important: .NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.126 and .NET Runtime 6.0.26.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0158
Updated: 2026-11-02

OSVBIT-dotnet-2024-0056No score

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: BIT-dotnet-2024-0056
Updated: 2026-11-02

OSVBIT-dotnet-sdk-2024-0056No score

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Record: BIT-dotnet-sdk-2024-0056
Updated: 2026-11-02

OSVRLSA-2024:0150No score

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:0150
Updated: 2026-11-02

OSVRLSA-2024:0157No score

Important: .NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:0157
Updated: 2026-11-02

OSVRLSA-2024:0158No score

Important: .NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.126 and .NET Runtime 6.0.26.

Security Fix(es):

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)
dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)
dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:0158
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 43 moreShow less