Our scanning tool pointed out some CVEs (ranked as High) that have been found in the on-prem datagateway application. These are third party libaries that need to be updated in the on-prem data gateway.
CVE-2024-4741, CVE-2025-9230, CVE-2024-6119 [fixed in version 3.2.6 of libssl]
C:\Program Files\On-premises data gateway\FabricIntegrationRuntime\5.0\Gateway\sxs\OracleV2Unbundle\1.0.0.0\libssl-3-x64.dll
CVE-2025-52999 [fixed in version 2.15.0 of com.fasterxml.jackson.core:jackson-core]
C:\Program Files\On-premises data gateway\FabricIntegrationRuntime\5.0\Gateway\Jars\V3\hive-exec-4.0.1.jar -> META-INF/maven/com.fasterxml.jackson.core/jackson-core
All of the above vulnerabilities are marked as a "High" risk and largely involve denial of service attacks which put the gateway at risk of being terminated without authorization. Please consider upgrading your third party dependencies.
1 Comment
- Note that this was vulnerability was pointed out here and largely ignored by the team: https://community.fabric.microsoft.com/t5/Service/OpenSSL-Vulnerability-in-On-Premises-Data-Gateway/m-p/4348552
