FastReport.Data.MsSql vulnerability CVE-2024-0056 in System.Data.SqlClient

[maximilianjungbrz]

Hello,
Our security scans show that you are using a vulnerable version of the package System.Data.SqlClient v4.8.5, even in the latest version 2024.2.11.
Can you please update the usages of System.Data.SqlClient and publish a new version?

CVE:
https://nvd.nist.gov/vuln/detail/CVE-2024-0056
which is fixed in version 4.8.6 GHSA-98g6-xh36-x2p7

The CVE has a high score of 8.7 and the hotfix of System.Data.SqlClient was already released 5 months ago

[BogdanStg]

Hello!

The current FastReport.Core.Data.MsSql connection uses the System.Data.SqlClient package version 4.8.6

You should be able to update your FastReport Community Edition to see the changes

Best regards,
Bogdan