Re: Microsoft Security Advisory CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data provider Information Disclosure Vulnerability

Question

Hi, We are using some VB.NET Windows/Web Applications, C#.Net Windows Class Library/Windows Service Applications, Framework 4.5/4.8 have been used in all of them and referred System.Data.SqlClient for SQL Server activities. Clients are using Framework 4.8 where our application is running. Recently, we came to know about "Microsoft Security Advisory CVE-2024-0056: Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data provider Information Disclosure Vulnerability" , so could you please provide your thoughts that do we need to take any steps to overcome this Vulnerability? Note: We are also using VB 6.0 Application which refers ADODB for SQL Server activities - Is any change required in that area?

Thanks,
--Sachi...

Answer 1

Hi @Sachidhanantham Ramalingam ,

You have to update both packages to their respective secure versions, please see the links below for details. https://github.com/dotnet/announcements/issues/292

Best Regards.

Jiachen Li

---

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.