Open mend-bolt-for-github[bot] opened 1 year ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2022-41064 - Medium Severity Vulnerability
Vulnerable Libraries - System.Data.SqlClient-4.6.25220.01.dll, System.Data.SqlClient-4.6.27618.01.dll, System.Data.SqlClient-4.700.20.37001.dll, System.Data.SqlClient-4.700.20.6702.dll, System.Data.SqlClient-4.700.20.37001.dll, System.Data.SqlClient-4.6.27618.01.dll, System.Data.SqlClient-4.700.20.6702.dll
System.Data.SqlClient-4.6.25220.01.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.4.2.nupkg
Path to vulnerable library: /azure-node-typescript-servicebus-trigger-endpoint/node_modules/serverless-azure-functions/node_modules/azure-functions-core-tools/bin/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.6.25220.01.dll** (Vulnerable Library)
System.Data.SqlClient-4.6.27618.01.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.6.1.nupkg
Path to vulnerable library: /azure-node-line-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/6/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll,/azure-node-typescript-servicebus-trigger-endpoint/node_modules/azure-functions-core-tools/bin/workers/powershell/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll,/azure-node-typescript-servicebus-trigger-endpoint/node_modules/serverless-azure-functions/node_modules/azure-functions-core-tools/bin/workers/powershell/6/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll,/azure-node-telegram-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/6/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll,/azure-node-typescript-servicebus-trigger-endpoint/node_modules/azure-functions-core-tools/bin/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.6.27618.01.dll** (Vulnerable Library)
System.Data.SqlClient-4.700.20.37001.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.8.2.nupkg
Path to vulnerable library: /azure-node-telegram-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/7/System.Data.SqlClient.dll,/azure-node-line-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/7/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.700.20.37001.dll** (Vulnerable Library)
System.Data.SqlClient-4.700.20.6702.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.8.1.nupkg
Path to vulnerable library: /azure-node-typescript-servicebus-trigger-endpoint/node_modules/serverless-azure-functions/node_modules/azure-functions-core-tools/bin/workers/powershell/7/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.700.20.6702.dll** (Vulnerable Library)
System.Data.SqlClient-4.700.20.37001.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.8.2.nupkg
Path to vulnerable library: /azure-node-telegram-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/7/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll,/azure-node-telegram-bot/node_modules/azure-functions-core-tools/bin/System.Data.SqlClient.dll,/azure-node-line-bot/node_modules/azure-functions-core-tools/bin/System.Data.SqlClient.dll,/azure-node-line-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/7/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.700.20.37001.dll** (Vulnerable Library)
System.Data.SqlClient-4.6.27618.01.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.6.1.nupkg
Path to vulnerable library: /azure-node-telegram-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/6/System.Data.SqlClient.dll,/azure-node-line-bot/node_modules/azure-functions-core-tools/bin/workers/powershell/6/System.Data.SqlClient.dll,/azure-node-typescript-servicebus-trigger-endpoint/node_modules/azure-functions-core-tools/bin/workers/powershell/System.Data.SqlClient.dll,/azure-node-typescript-servicebus-trigger-endpoint/node_modules/serverless-azure-functions/node_modules/azure-functions-core-tools/bin/workers/powershell/6/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.6.27618.01.dll** (Vulnerable Library)
System.Data.SqlClient-4.700.20.6702.dll
System.Data.SqlClient
Library home page: https://api.nuget.org/packages/system.data.sqlclient.4.8.1.nupkg
Path to vulnerable library: /azure-node-typescript-servicebus-trigger-endpoint/node_modules/serverless-azure-functions/node_modules/azure-functions-core-tools/bin/workers/powershell/7/runtimes/unix/lib/netcoreapp2.1/System.Data.SqlClient.dll
Dependency Hierarchy: - :x: **System.Data.SqlClient-4.700.20.6702.dll** (Vulnerable Library)
Found in base branch: master
Vulnerability Details
.NET Framework Information Disclosure Vulnerability Mend Note: Converted from WS-2022-0377, on 2022-11-10.
Publish Date: 2022-11-09
URL: CVE-2022-41064
CVSS 3 Score Details (5.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Adjacent - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-8g2p-5pqh-5jmc
Release Date: 2022-11-09
Fix Resolution: Microsoft.Data.SqlClient - 1.1.4,2.1.2;System.Data.SqlClient - 4.8.5
Step up your Open Source Security Game with Mend here