Forum Discussion

kniper2185's avatar
kniper2185
Copper Contributor
Sep 03, 2024
Solved

Unpatched known vulnerabilities SQL Server 2019 GDR

We are running an installation of SQL Server 2019 GDR (version 15.0.2116.2) and I see we have these vulnerable commons-collections-3.2.1.jar-files present in the following 2 locations: C:\Program F...
kniper2185's avatar
kniper2185
Copper Contributor
Sep 05, 2024
So I already did install the latest GDR-update KB5040986 from July 9, 2024.

Why would installing KB5039747 make a difference for this particular security issue?
I understand that GDR-updates should contain all security related fixes. Where can I find that installing this patch will resolve this?
Also the CVE's I mentioned are very old already, which make me doubt this:
CVE-2015-6420 ---> published 2015-12-15
CVE-2017-15708 --> published 2017-12-11

I'm asking this, because I don't want to take any risks with this SQL Server installation since it's being used for quite an old application at the time and the software is being maintained by a software supplier who, given our experience with them, aren't going to resolve potential issues quickly.

My goal is to merely resolve these vulnerabilities without taking too much risks.
  • kniper2185's avatar
    kniper2185
    Copper Contributor
    Sep 10, 2024

    So I took the effort to install this SQL Server 2019 in a test VM-environment and I did apply KB5039747 (version 15.0.4385.2) and indeed the commons-collections-3.2.1.jar is updated to commons-collections-3.2.2.jar

    The date of this file is the 25th of July 2024, so pretty recent. Can I assume this fix will be applied in the next https://learn.microsoft.com/nl-nl/troubleshoot/sql/releases/sqlserver-2019/build-versions#sql-server-2019-gdr-builds through Windows Update?

     

    • kniper2185's avatar
      kniper2185
      Copper Contributor
      Sep 14, 2024

      Unfortunately installing https://support.microsoft.com/en-us/topic/kb5042214-description-of-the-security-update-for-sql-server-2019-gdr-september-10-2024-a178ef94-4df8-452f-a1b8-f70d7ab7745f didn't update the commons-collections-3.2.1.jar-files in

      - C:\Program Files (x86)\Microsoft SQL Server\150\DTS\Extensions\Common\Jars

      - C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars

Resources