System.Data.SqlClient v4.4.0 referenced by AWSXRayRecorder v2.14.0 has security issue

[OceanSJY]

The System.Data.SqlClient v4.4.0 was highlighed by Veracode since it has high severity issue:

• Issue ID: 271795222
• Issue Type: Vulnerability
• Severity: 8.7
• Description: CVE-2024-0056: Credential Exposure
  Microsoft.Data.SqlClient is vulnerable to Credential Exposure. The vulnerability is due to improper handling of TLS connections, allowing an attacker to read or modify traffic between the server and client. The attacker would have to position themself between the client and server, resulting in database credential exposure.

Could you please release a new version to reference a new version (e.g. v4.8.6) of System.Data.SqlClient to fix this issue?

[mxiamxia]

Thanks for reporting it. Will take a look

aws-xray-sdk-dotnet/sdk/src/Handlers/SqlServer/AWSXRayRecorder.Handlers.SqlServer.csproj

Line 41 in 018bfa6

<PackageReference Include="System.Data.SqlClient" Version="4.4.0" />