high 8.7

CVE-2024-0056 json

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

published 2024-01-09 2 y ago modified 2026-09-08 2 mo ago also BIT-dotnet-2024-0056 , BIT-dotnet-sdk-2024-0056 , EUVD-2024-0311 , GHSA-98g6-xh36-x2p7

cvss: 8.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

Patch / fix

fixed in 21 distros 4 links 1

nuget Microsoft.Data.SqlClient 2.1.7, 3.1.5, 4.0.5, 5.1.3
nuget System.Data.SqlClient 4.8.6
bitnami dotnet 6.0.26, 7.0.15, 8.0.1
bitnami dotnet-sdk 6.0.26, 7.0.15, 8.0.1
Microsoft Microsoft SQL Server 2022 (GDR) 16.0.1110.1
Microsoft .NET 6.0 6.0.26
Microsoft .NET 7.0 7.0.15
Microsoft .NET 8.0 8.0.1
Microsoft Microsoft.Data.SqlClient 2.1.7, 3.1.5, 4.0.5, 5.1.3
Microsoft System.Data.SqlClient 4.8.6
Microsoft Microsoft Visual Studio 2022 version 17.2 17.2.23
Microsoft Microsoft Visual Studio 2022 version 17.4 17.4.15
Microsoft Microsoft Visual Studio 2022 version 17.6 17.6.11
Microsoft Microsoft Visual Studio 2022 version 17.8 17.8.4
Microsoft Microsoft SQL Server 2022 (CU 10) 16.0.4100.1
Microsoft Microsoft .NET Framework 4.8 4.8.04690.02
Microsoft Microsoft .NET Framework 3.5 AND 4.8 4.8.04690.02
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 4.7.04081.03
Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.04081.02
Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 4.8.09214.01
Microsoft Microsoft .NET Framework 2.0 Service Pack 2 3.0.50727.8976

red hat almalinux rocky linux alpine

rh-dotnet60-dotnet RHEL 6.0 DOTNET 6.0.126-1.el7_9
rh-dotnet60-dotnet-host RHEL 6.0 DOTNET 6.0.26-1.el7_9
rh-dotnet60-dotnet-sdk-6.0 RHEL 6.0 DOTNET 6.0.126-1.el7_9
rh-dotnet60-dotnet-hostfxr-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9
rh-dotnet60-dotnet-runtime-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9
rh-dotnet60-dotnet-templates-6.0 RHEL 6.0 DOTNET 6.0.126-1.el7_9
rh-dotnet60-aspnetcore-runtime-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9
rh-dotnet60-dotnet-apphost-pack-6.0 RHEL 6.0 DOTNET 6.0.26-1.el7_9

red hat advisories RHSA-2024:0255 RHSA-2024:0157 RHSA-2024:0158 RHSA-2024:0152 RHSA-2024:0151 RHSA-2024:0156

dotnet AlmaLinux 8 8.0.101-1.el8_9
dotnet-host AlmaLinux 8 8.0.1-1.el8_9
dotnet-sdk-8.0 AlmaLinux 8 8.0.101-1.el8_9
dotnet-hostfxr-8.0 AlmaLinux 8 8.0.1-1.el8_9
dotnet-runtime-8.0 AlmaLinux 8 8.0.1-1.el8_9
dotnet-templates-8.0 AlmaLinux 8 8.0.101-1.el8_9
aspnetcore-runtime-8.0 AlmaLinux 8 8.0.1-1.el8_9
dotnet-apphost-pack-8.0 AlmaLinux 8 8.0.1-1.el8_9

almalinux advisories ALSA-2024:0150 ALSA-2024:0151 ALSA-2024:0152 ALSA-2024:0156 ALSA-2024:0157 ALSA-2024:0158

dotnet8.0 Rocky Linux 8 8.0.101-1.el8_9
dotnet7.0 Rocky Linux 8 7.0.115-1.el8_9
dotnet6.0 Rocky Linux 8 6.0.126-1.el8_9

rocky linux advisories RLSA-2024:0150 RLSA-2024:0157 RLSA-2024:0158

dotnet6-build Alpine 3.20, Alpine 3.19 6.0.126-r0
dotnet7-build Alpine 3.19 7.0.115-r0
dotnet6-runtime Alpine 3.20, Alpine 3.19 6.0.26-r0
dotnet7-runtime Alpine 3.19 7.0.15-r0

alpine advisories ALPINE-CVE-2024-0056

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-0056 updated 2025-11-21 cvss 7.5

dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS)

Red Hat .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet60-dotnet 6.0.126-1.el7_9, rh-dotnet60-dotnet-host 6.0.26-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.126-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.126-1.el7_9, +6 more Red Hat .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet60-dotnet 6.0.126-1.el7_9, rh-dotnet60-dotnet-host 6.0.26-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.126-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.126-1.el7_9, +6 more Red Hat .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet60-dotnet 6.0.126-1.el7_9, rh-dotnet60-dotnet-host 6.0.26-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.126-1.el7_9, rh-dotnet60-dotnet-hostfxr-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-runtime-6.0 6.0.26-1.el7_9, rh-dotnet60-dotnet-templates-6.0 6.0.126-1.el7_9, +6 more
fixed: vendor fix RHSA-2024:0255
Red Hat CodeReady Linux Builder (v. 8) dotnet 8.0.101-1.el8_9, dotnet-host 8.0.1-1.el8_9, dotnet6.0 6.0.126-1.el8_9, dotnet7.0 7.0.115-1.el8_9, dotnet8.0 8.0.101-1.el8_9, dotnet-sdk-6.0 6.0.126-1.el8_9, +27 more
fixed: vendor fix RHSA-2024:0158
Red Hat CodeReady Linux Builder (v. 9) dotnet-host 8.0.1-1.el9_3, dotnet6.0 6.0.126-1.el9_3, dotnet7.0 7.0.115-1.el9_3, dotnet8.0 8.0.101-1.el9_3, dotnet-sdk-6.0 6.0.126-1.el9_3, dotnet-sdk-7.0 7.0.115-1.el9_3, +26 more
fixed: vendor fix RHSA-2024:0156
Red Hat Enterprise Linux AppStream (v. 8) dotnet 8.0.101-1.el8_9, dotnet-host 8.0.1-1.el8_9, dotnet6.0 6.0.126-1.el8_9, dotnet7.0 7.0.115-1.el8_9, dotnet8.0 8.0.101-1.el8_9, dotnet-sdk-6.0 6.0.126-1.el8_9, +27 more
fixed: vendor fix RHSA-2024:0158
Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 8.0.1-1.el9_3, dotnet6.0 6.0.126-1.el9_3, dotnet7.0 7.0.115-1.el9_3, dotnet8.0 8.0.101-1.el9_3, dotnet-sdk-6.0 6.0.126-1.el9_3, dotnet-sdk-7.0 7.0.115-1.el9_3, +26 more
fixed: vendor fix RHSA-2024:0156

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-317-15 updated 2025-11-11 cvss 8.7

Siemens COMOS

Siemens COMOS < 10.4.5
affected: fixed in V10.4.5 support.sw.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-135-02 updated 2025-05-13 cvss 8.7

Siemens INTRALOG WMS

Siemens INTRALOG WMS < V5
affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-100-02 updated 2025-05-06 cvss 8.7

Siemens SIDIS Prime

Siemens SIDIS Prime <V4.0.700
affected: fixed in V4.0.700

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-228-02 updated 2024-08-13 cvss 8.0

Siemens INTRALOG WMS

Siemens INTRALOG WMS <V4
affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-05-08)

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
GitHub	3.1	8.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA	3.1	8.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
OSV	3.1	8.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
nuget	Microsoft.Data.SqlClient	<2.1.7 >=3.0.0, <3.1.5 >=4.0.0, <4.0.5 >=5.0.0, <5.1.3	2.1.7 3.1.5 4.0.5 5.1.3
nuget	System.Data.SqlClient	<4.8.6	4.8.6
bitnami	dotnet	>=6.0.0, <6.0.26 >=7.0.0, <7.0.15 >=8.0.0, <8.0.1	6.0.26 7.0.15 8.0.1
bitnami	dotnet-sdk	>=6.0.0, <6.0.26 >=7.0.0, <7.0.15 >=8.0.0, <8.0.1	6.0.26 7.0.15 8.0.1

Affected products

Microsoft Microsoft SQL Server 2022 (GDR)
Microsoft .NET 6.0
Microsoft .NET 7.0
Microsoft .NET 8.0
Microsoft Microsoft.Data.SqlClient
Microsoft System.Data.SqlClient
Microsoft Microsoft Visual Studio 2022 version 17.2
Microsoft Microsoft Visual Studio 2022 version 17.4
Microsoft Microsoft Visual Studio 2022 version 17.6
Microsoft Microsoft Visual Studio 2022 version 17.8
Microsoft Microsoft SQL Server 2022 (CU 10)
Microsoft Microsoft .NET Framework 4.8
Microsoft Microsoft .NET Framework 3.5 AND 4.8
Microsoft Microsoft .NET Framework 3.5 AND 4.7.2
Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft Microsoft .NET Framework 3.5 AND 4.8.1
Microsoft Microsoft .NET Framework 2.0 Service Pack 2

Classification

Weakness

CWE-319 Cleartext Transmission of Sensitive Information

Technology feeds

Microsoft SQL Server rss critical rss

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2024-0056
vendor-advisory, web, patch, advisory
nvd.nist.gov /vuln/detail/CVE-2024-0056
advisory, web
github.com /dotnet/announcements/issues/292
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix

Vendor advisories

CISA SSVC

Exploit prediction

CVSS scores

Affected packages

Affected products

Classification

References

Sources