.NET Framework Information Disclosure Vulnerability

Affected: NuGet: Microsoft.Data.SqlClient, NuGet: System.Data.SqlClient

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages.

A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a timeout occurring under high load can cause incorrect data to be returned as the result of an asynchronously executed query.

## <a name="mitigation-factors"></a>Mitigation factors

If you are not talking to Microsoft SQL Server from your application you are not affected by this vulnerability.

### <a name="how-affected"></a>How do I know if I am affected?

.NET has two types of dependencies: direct and transitive. Direct dependencies are dependencies where you specifically add a package to your project, transitive dependencies occur when you add a package to your project that in turn relies on another package.

For example, the Microsoft.AspNetCore.Mvc package depends on the Microsoft.AspNetCore.Mvc.Core package. When you add a dependency on Microsoft.AspNetCore.Mvc in your project, you're taking a transitive dependency on Microsoft.AspNetCore.Mvc.Core. Any application that has a direct or transitive dependency on the  affected packages listed above are vulnerable.

### <a name="how-fix"></a>How do I fix the issue?

* If you are using System.Data.SqlClient on .NET Framework you must install the November update for .NET Framework * If you are using System.Data.SqlClient on .NET Core…