Bug 2255384 (CVE-2024-0056)
| Summary: | CVE-2024-0056 dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Patrick Del Bello <pdelbell> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | andrew.slice, bodavis, dbhole, omajid, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | .NET SDK 6.0.126 and .NET Runtime 6.0.26 and .NET SDK 7.0.115 and .NET Runtime 7.0.15 | Doc Type: | --- |
| Doc Text: |
A vulnerability was found in the .NET Framework. This vulnerability exists in the Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data provider where an attackercan perform an AiTM (adversary-in-the-middle) attack between the SQL client and the SQL server. This may allow the attacker to steal authentication credentials intended for the database server, even if the connection is established over an encrypted channel like TLS.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2255392, 2257551, 2257552, 2257553 | ||
| Bug Blocks: | 2255383 | ||
|
Description
Patrick Del Bello
2023-12-20 14:03:28 UTC
Created dotnet6.0 tracking bugs for this issue: Affects: fedora-all [bug 2257551] Created dotnet7.0 tracking bugs for this issue: Affects: fedora-all [bug 2257552] Created dotnet8.0 tracking bugs for this issue: Affects: fedora-all [bug 2257553] This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:0151 https://access.redhat.com/errata/RHSA-2024:0151 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:0152 https://access.redhat.com/errata/RHSA-2024:0152 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0150 https://access.redhat.com/errata/RHSA-2024:0150 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:0156 https://access.redhat.com/errata/RHSA-2024:0156 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0158 https://access.redhat.com/errata/RHSA-2024:0158 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0157 https://access.redhat.com/errata/RHSA-2024:0157 This issue has been addressed in the following products: .NET Core on Red Hat Enterprise Linux Via RHSA-2024:0255 https://access.redhat.com/errata/RHSA-2024:0255 |