Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
Recommended action: Upgrade to 4.8.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages. A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query. <a name="mitigation-factors"</aMitigation factors If you are not talking to Microsoft SQL Server from your application you are not affected by this vulnerability. <a name="how-affected"</aHow do I know if I am affected? .NET has two types of dependencies: direct and transitive. Direct dependencies are dependencies where you specifically add a package to your project, transitive dependencies occur when you add a package to your project that in turn relies on another package. For example, the Microsoft.AspNetCore.Mvc package depends on the Microsoft.AspNetCore.Mvc.Core…
Recommended action: Upgrade to 4.8.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.