Skip to the content
The Update Bureau
SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
Patch Tuesday

KB5042215

KB5042215: Security update for SQL Server 2017, CU branch, September 2024. CDC metadata safeguards added; temporal-table quoting fixed

In short

Fixes 13 vulnerabilities and includes a known CDC issue: columns with commas might disappear from CDC tracking tables and cause capture jobs to fail.

Does it affect you? Applies to: SQL Server 2017 installations with SQL Server 2017 or a CU release through CU31 GDR installed. The package is for x64 systems; the update is optional on computers that do not host SQL Server Reporting Services.

Build
14.0.3475.1
Servicing branch
CU
Security
13 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues After applying the update, use this mitigation if columns were dropped from CDC tracking tables. The trace flag and restart are also part of the preventive steps before an upgrade.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Improvements 2 changes

Query Execution

For: SQL Server users of PREDICT

  • A check of the model used by PREDICT helps avoid errors caused by an incorrect model.1
    Adds validation for the MODEL parameter when running PREDICT.

Replication

For: SQL Server administrators using CDC

  • CDC gets a safeguard that can block data definition changes to its metadata.1
    Adds metadata definition lockdown capability for change data capture (CDC) to block data definition language (DDL) operations.

Fix 1 change

Temporal

For: SQL Server users of temporal tables

  • Stored procedures that manage temporal tables correctly quote table and column names when building internal SQL batches.2
    Fixes cases where table and column names read from database metadata were not correctly quoted.

Known issues

  1. Open Affects: Organizations and IT administrators

    CDC capture job might fail if columns are missing in CDC change tables

    After this update, CDC-enabled tables with column names containing commas might have those columns missing from their CDC tracking tables, which can cause capture jobs or applications to fail. Other symbols in CDC tracking-table column names can cause a CDC metadata upgrade to fail during a restore or SQL Server upgrade.3

    How to apply the workaround SQL Trace Flag

    Use trace flag T15006 before upgrading and restart the SQL Server service. If the update is already applied, use the flag and restart; retry an affected restore, or disable and reenable CDC on an affected table if the GDR upgrade dropped columns. Reenabling CDC causes change data to be lost.3

    Step-by-step workaround instructions
    5 steps
    Show steps Hide steps
    Step-by-step procedure
    1. In SQL Server Configuration Manager, open the instance Properties and select the Startup Parameters tab.
    2. Add trace flag T15006, then select Add and Apply.
    3. Restart the SQL Server service and perform the upgrade while the trace flag is active.
    4. If the GDR is already applied and a restore was affected, add the flag and restart as described above, then repeat the database restore.
    5. If the GDR upgrade dropped columns, add the flag and restart, then disable and reenable CDC on the affected table with sp_cdc_disable_table and sp_cdc_enable_table. This causes change data to be lost.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5040940
Replaced by
KB5046061
VersionBuildChannel
2017 14.0.3475.1 General availability

Security

13 vulnerabilities fixed
12 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2024-26186
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-26191
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37335
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37338
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37339
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37340
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37965
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-43474
Microsoft SQL Server Information Disclosure Vulnerability
 Important 7.6
CVE-2024-37337
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37342
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37966
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37341
Microsoft SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2017
538.8 MB
sqlserver2017-kb5042215-x64.exe Main update · KB5042215 SHA-1: 7e226891…0f459c

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Adds a validation for the MODEL parameter when running PREDICT to avoid errors that occur because of the input of wrong models. support.microsoft.com
  2. 2. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
  3. 3. If your CDC-enabled tables have columns whose names contain commas, these columns might be missing from your CDC tracking tables (cdc.<capture_instance>_CT). This condition might cause the capture job to fail. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake