Closed mend-bolt-for-github[bot] closed 7 months ago
To fix the issue we should probable change our EF core dependency from hardcoded version to using "3.1.*"
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
Won't fix the issue now, efcore 3.1 is EOL and will not get security updates. The plan is to remove the efcore 3.1 support
CVE-2022-41064 - Medium Severity Vulnerability
Vulnerable Libraries - microsoft.data.sqlclient.1.1.3.nupkg, system.data.sqlclient.4.8.1.nupkg
microsoft.data.sqlclient.1.1.3.nupkg
Provides the data provider for SQL Server. These classes provide access to versions of SQL Server an...
Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.1.1.3.nupkg
Path to dependency file: /src/VisualStudio/Tools/Test/OpenRiaServices.VisualStudio.DomainServices.Tools.Test.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/1.1.3/microsoft.data.sqlclient.1.1.3.nupkg
Dependency Hierarchy: - EFCoreModels-1.0.0 (Root Library) - microsoft.entityframeworkcore.sqlserver.3.1.32.nupkg - :x: **microsoft.data.sqlclient.1.1.3.nupkg** (Vulnerable Library)
system.data.sqlclient.4.8.1.nupkg
Provides the data provider for SQL Server. These classes provide access to versions of SQL Server an...
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.8.1.nupkg
Path to dependency file: /src/OpenRiaServices.EntityFramework/Test/CodeFirstModel/EFCodeFirstModels.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.data.sqlclient/4.8.1/system.data.sqlclient.4.8.1.nupkg
Dependency Hierarchy: - :x: **system.data.sqlclient.4.8.1.nupkg** (Vulnerable Library)
Found in HEAD commit: 2505fca835708b6a24650d21bd678cff09bb49e8
Found in base branch: main
Vulnerability Details
.NET Framework Information Disclosure Vulnerability Mend Note: Converted from WS-2022-0377, on 2022-11-10.
Publish Date: 2022-11-09
URL: CVE-2022-41064
CVSS 3 Score Details (5.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Adjacent - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-8g2p-5pqh-5jmc
Release Date: 2022-11-09
Fix Resolution: Microsoft.Data.SqlClient - 1.1.4,2.1.2;System.Data.SqlClient - 4.8.5
Step up your Open Source Security Game with Mend here