search

scottksmith95 / LINQKit

LINQKit is a free set of extensions for LINQ to SQL and Entity Framework power users.
MIT License
1.65k stars 165 forks source link

System.data.sqlclient 4.7.0 has high vulnerability CVE-2024-0056. #199

Closed pmiddleton closed 5 months ago

pmiddleton commented 5 months ago

EntityFramework 6.3.0 transitively uses System.data.sqlclient 4.7.0 which has a high level vulnerability CVE-2024-0056.

See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056

Please upgrade to EntityFramework 6.5 when it releases this month to upgrade System.data.sqlclient to 4.8.6 which resolved this CVE

See https://learn.microsoft.com/en-us/ef/ef6/what-is-new/

StefH commented 5 months ago

https://github.com/scottksmith95/LINQKit/pull/200