For the complete documentation index, see llms.txt. This section of documentation is indexed by https://docs.particular.net/transports/llms.txt. Here is the markdown version of this page. Markdown versions of documentation pages are available by appending .md to the page URL. Directory URLs use index.md.

SQL Server Transport Upgrade Version 2.x to 2.2.4

This document explains how to patch a system for SQL injection vulnerability in the SQL Server Transport using hotfix release 2.2.4.

Updating the NuGet package

This vulnerability can be fixed by upgrading the SQL Server Transport package that is being used. The package can be updated by issuing the following command in the Package Manager Console within Visual Studio:

Update-Package NServiceBus.SqlServer -Version 2.2.4

After the package has been updated, all affected endpoints must be rebuilt and redeployed.

Patching a deployed system

This vulnerability can also be fixed by updating the SQL Server Transport DLL without the need to rebuild and redeploy an affected endpoint by following these steps:

  1. Update the NuGet package
  2. For each affected endpoint:
    1. Stop the endpoint.
    2. Copy the NServiceBus.Transport.SqlServer.dll file from the updated NuGet package to directory where binaries of the endpoint are stored. Make sure that updated version of the .dll overwrites the previous one.
    3. Restart the endpoint.

Related Articles

In this article