is CVE-2022-37434 relevant for ODBC Driver for SQL Server?

Oliver C 0

Hi,

our Black Duck Binary Analysis reported ODBC Driver for SQL Server as security risk as it contains zlib library version 1.2.11 which contains vulnerability described in CVE-2022-37434.

we would like to ask if this vulnerability is relevant for ODBC driver (if odbc driver uses inflateGetHeader call) and if it is relevant when we can expect new version of ODBC Driver for SQL Server with updated zlib to be released.

Regards,

Cernansky

SAP Business One Developer

Seeya Xi-MSFT 16,441 Reputation points

2023-03-24T02:41:47.11+00:00

Hi Oliver C,

Microsoft has not yet provided any information about when an updated version of the driver with an updated zlib library might be released. You can post this question to the feedback site where someone from the product team will see it.

https://feedback.azure.com/d365community/forum/04fe6ee0-3b25-ec11-b6e6-000d3a4f0da0

Best regards,

Seeya
Oliver C 0 Reputation points

2023-03-24T07:53:13.6866667+00:00

HI Seeya,

thank you for your answer.

this feedback site looks to be more suited for suggestions and ideas, my questions is more of a security issue.

if possible could you advice who to contact regarding security questions for ODBC Driver? maybe development team?

we just need to know if ODBC Driver is affected by CVE-2022-37434 or not.

Regards,

Oliver
Seeya Xi-MSFT 16,441 Reputation points

2023-03-24T08:32:50.14+00:00

Hi @Oliver C,

You could try posting this on the feedback site and someone from the product team might contact the development staff.

Best regards,

Seeya