Skip to the content
The Update Bureau
SQL Server 2017 GDR SQL Server 2017 GDR Security update
Patch Tuesday

KB5042217

KB5042217: Security update for SQL Server 2017, GDR branch, September 2024. Twelve security flaws addressed; CDC column loss remains possible

In short

Addresses 12 Important vulnerabilities in SQL Server 2017. It also introduces a known CDC issue that can leave columns missing and cause capture jobs or applications to fail; a KEEP_CDC restore can report an error near the end even when the database restores successfully.

Does it affect you? Applies to: SQL Server 2017 installations on the GDR servicing branch. The known issue affects databases with change data capture (CDC) enabled, particularly when tracked column names contain commas or certain other symbols.

Build
14.0.2060.1
Servicing branch
GDR
Security
12 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • In detail Columns with commas in their names might be missing from CDC tracking tables. Certain other symbols can cause CDC upgrade errors.

The official sources are linked at the end of the page.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Improvements 2 changes

Query Execution

  • Using PREDICT with an incorrect model now gets a validation check to help avoid errors.1
    Adds validation for the MODEL parameter when running PREDICT.

Replication

  • CDC can block data-definition operations through a new metadata protection capability.2
    Adds metadata definition lockdown capability to the change data capture (CDC) feature to block data definition language (DDL) operations.

Fix 1 change

Temporal

  • Stored procedures that manage temporal tables correctly quote table and column names in cases where they previously might not.3
    Corrects quoting when table and column names read from database metadata are used to build internal SQL Server batches.

Known issues

  1. Open Affects: Organizations and IT administrators

    CDC capture job might fail if columns are missing in CDC change tables

    In databases with CDC enabled, columns whose names contain commas might be missing from CDC tracking tables, causing capture jobs or applications that use those tables to fail. During some restore or upgrade paths, columns with certain other symbols can also cause CDC upgrade errors. A KEEP_CDC restore might report an error near the end, even though the database restores successfully.4

    How to apply the workaround SQL Trace Flag

    Enable trace flag T15006 and restart SQL Server before upgrading. If the GDR is already applied and columns were dropped, enable the flag and restart, then repeat the affected restore or disable and reenable CDC on the affected table; the latter causes change data to be lost.4

    Step-by-step workaround instructions
    5 steps
    Show steps Hide steps
    Step-by-step procedure
    1. In SQL Server Configuration Manager, open the instance's Properties and go to the Startup Parameters tab.
    2. Add trace flag T15006, select Add, then Apply, and restart the SQL Server service.
    3. Perform the upgrade while the trace flag is active.
    4. If the GDR is already applied and the restore scenario was affected, repeat the database restore.
    5. If the GDR upgrade dropped columns, disable and reenable CDC on the affected table with sp_cdc_disable_table and sp_cdc_enable_table; this causes change data to be lost.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5040942
Replaced by
KB5046058
VersionBuildChannel
2017 14.0.2060.1 General availability

Security

12 vulnerabilities fixed
12 important
VulnerabilitySeverityCVSS
CVE-2024-26186
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-26191
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37335
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37338
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37339
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37340
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37965
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-43474
Microsoft SQL Server Information Disclosure Vulnerability
 Important 7.6
CVE-2024-37337
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37342
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37966
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1

Downloads (Microsoft Update Catalog)

Package 2017
448.2 MB
sqlserver2017-kb5042217-x64.exe Main update · KB5042217 SHA-1: b3c9fd21…c807ed

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Adds a validation for the MODEL parameter when running PREDICT to avoid errors that occur because of the input of wrong models. support.microsoft.com
  2. 2. Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations. support.microsoft.com
  3. 3. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
  4. 4. If your CDC-enabled tables have columns whose names contain commas, these columns might be missing from your CDC tracking tables (cdc.<capture_instance>_CT). support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake