Upcoming improvements to Azure Data Factory and Azure Synapse Pipeline infrastructure in response to CVE-2022-29972

Executive Summary Microsoft recently mitigated and remediated a vulnerability affecting Azure Data Factory and Azure Synapse Pipelines. The vulnerability was found in the third-party ODBC data connector used to connect to Amazon Redshift, in Integration Runtime IR in Azure Synapse Pipelines, and...

Vulnerability mitigated in the third-party Data Connector used in Azure Synapse pipelines and Azure Data Factory (CVE-2022-29972)

Summary Summary Microsoft recently mitigated a vulnerability in Azure Data Factory and Azure Synapse pipelines. The vulnerability was specific to the third-party Open Database Connectivity ODBC driver used to connect to Amazon Redshift in Azure Synapse pipelines and Azure Data Factory Integration...

Insight Software: CVE-2022-29972 Magnitude Simba Amazon Redshift ODBC Driver

...

Magnitude Simba Amazon Athena ODBC Driver 参数注入漏洞

Magnitude Simba Amazon Athena ODBC Driver is an ODBC driver from Magnitude, Inc. It is used to connect real-time data from Amazon Athena directly from any application that supports ODBC connections. The Magnitude Simba Amazon Athena ODBC Driver has a parameter injection vulnerability that stems...

CVE-2022-29971: Improper Neutralization of Argument Delimiters in a Command

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1.1.17 may allow a local user to execute arbitrary code...

CVE-2022-29972: Improper Neutralization of Argument Delimiters in a Command

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver 1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52 may allow a local user to execute arbitrary code...

PT-2022-19935

Name of the Vulnerable Software and Affected Versions Magnitude Simba Amazon Athena ODBC Driver versions 1.1.1 through 1.1.x before 1.1.17 Description An argument injection vulnerability in the browser-based authentication component may allow a local user to execute arbitrary code. Recommendation...

Oracle Database Server Input Validation Error Vulnerability (CNVD-2022-36954)

Oracle Database Server is a relational database management system from Oracle Corporation. Java VM is one of the Java Virtual Machine components.An input validation error vulnerability exists in the RDBMS Gateway/Generic ODBC connection component of Oracle Database Server, which originates from...

CVE-2022-21411

Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to...

Code injection

Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to...

CVE-2022-21411

Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to...

CVE-2022-21411

CVE-2022-21411 : Oracle Database Server’s RDBMS Gateway / Generic ODBC Connectivity component is affected. Affected versions are 12.1.0.2, 19c, and 21c . The vulnerability allows a low-privilege attacker with Create Session privilege and network access via Oracle Net to compromise the RDBMS Gatew...

CVE-2022-21411: Undefined Security Weakness

Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to...

PT-2022-2427

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 19c, and 21c Description The issue is related to insufficient input validation in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. This easily exploitable vulnerabilit...

ALPINE-CVE-2022-26651

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The funcodbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. Th...

PT-2022-2477

Name of the Vulnerable Software and Affected Versions Magnitude Simba Amazon Redshift ODBC Driver versions 1.4.14 through 1.4.21.1001 Magnitude Simba Amazon Redshift ODBC Driver versions 1.4.22 through 1.4.x before 1.4.52 Microsoft Azure Synapse affected versions not specified Microsoft Azure Dat...

Asterisk -- func_odbc: Possible SQL Injection

The Asterisk project reports: Some databases can use backslashes to escape certain characters, such as backticks. If input is provided to funcodbc which includes backslashes it is possible for funcodbc to construct a broken SQL query and the SQL query to fail...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise v11 & v12 (CVE-2021-3711)

Summary Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprsie. The DataDirect ODBC Drivers & Nodejs used by IBM App Connect Enterprise and IBM Integration Bus have addressed the applicable CVEs Vulnerability Details CVEID: CVE-2021-3711 DESCRIPTION: OpenSSL is...

RUSTSEC-2022-0036 project abandoned

The r2d2-odbc-api crate might be an alternative...

odbc-avro (>=0.1.0, <=0.2.1), odbc-iter (>=0.1.0, <=0.2.7) +6 more potentially affected by unknown CVE via odbc (>=0.9.17, <=0.16.1)

odbc CARGO version =0.9.17, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1 - unidbpgsql 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0039...