Security scan on sql_server_2019_express_x64_ENU.exe identified a vulnerability CVE-2015-7501

Question

CVE-2015-7501 description: Apache Commons Collections 3.2.1v has a security flaw in the InvokeTransformer class whereby serializable collections can be built that execute arbitrary Java code.

To mitigate this vulnerability we need to upgrade the Apache Commons Collections from 3.2.1v to 3.2.2v which has security fix for this.

Path within file matching detected library:
/Program Files/Microsoft SQL Server/150/DTS/Extensions/Common/Jars/commons-collections-3.2.1.jar

Steps to Reproduce: - Run a security scan using security scanning tool.

Please let me know if there is any patch present for SQL Server 2019 express which has a fix for this vulnerability.

Answer 1

Hi @D K, Harini ,

Please apply the latest CU14 for SQL server 2019 Express, this update contains all fixes that were released after the initial release of SQL Server 2019. If it is not work, please feel free to let us know.

Cumulative Update Package 14 for SQL Server 2019 - KB5007182

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

This CU14 release does NOT resolve the Commons-Collections 3.2.1 vulnerability.

Path for this vulnerability is found in:

C:\Program Files (x86)\Microsoft SQL Server Management Studio 19\Common7\IDE\CommonExtensions\Microsoft\SSIS\160\Extensions\Common\Jars