mend-for-github-com[bot]
commented
1 year ago :heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
WS-2022-0377 - Medium Severity Vulnerability
Provides the data provider for SQL Server. These classes provide access to versions of SQL Server an...
Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.1.0.19269.1.nupkg
Path to dependency file: /src/Conduit/Conduit.csproj
Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/1.0.19269.1/microsoft.data.sqlclient.1.0.19269.1.nupkg
Dependency Hierarchy: - Conduit-1.0.0 (Root Library) - microsoft.entityframeworkcore.sqlserver.3.1.3.nupkg - :x: **microsoft.data.sqlclient.1.0.19269.1.nupkg** (Vulnerable Library)
Found in HEAD commit: 8d79e3658239d0d1aff62d275310f772e0298fa0
Found in base branch: main
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages. A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query.
Publish Date: 2022-11-09
URL: WS-2022-0377
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-8g2p-5pqh-5jmc
Release Date: 2022-11-09
Fix Resolution: Microsoft.Data.SqlClient - 1.1.4,2.1.2;System.Data.SqlClient - 4.8.5