A New SQL Server Vulnerability (2022-06-18 DBW)

Database Weekly for June 18, 2022 Problems displaying this newsletter? [View online](. [Database Weekly]( The Complete Weekly Roundup of SQL Server News by SQLServerCentral.com Hand-picked content to sharpen your professional edge Editorial  A New SQL Server Vulnerability This week I was at [VS Live](, which was a great conference in Austin. They have a few more around the country, and I'll be at the Redmond one, but they are a small, fun, multi-tech software conference with lots of development and a few data topics. After prepping for my sessions, I logged into mail and saw a bunch of new SQL Server patches, all of them seemingly addressing a new potential attack vector. The [CVE-2022-29143]( issue is a potential SQL Server remote code execution vulnerability that could be serious, but has a high level of complexity and isn't likely to be a problem. That being said, when there is a potential security issue, Microsoft takes it seriously and works on building a patch quickly. They've released this patch for all versions of SQL Server from 2014-2019. Apply this patch. There are two patches for each version, one being a specific patch level and one a GDR. If you don't know the difference on which one to apply, you ought to learn, and then patch your systems up to the latest CU so you can just apply a patch like this when it's released. Keeping up with patches can be a pain, and certainly it is a task that makes some of us nervous. It's also hard when third party software vendors don't certify their wares on different SQL Server versions. I'd like to think the CU process makes this simpler and easier, and most software that works on RTM will also work on CU17. However, you need to test, and you should have a process in place to test and apply patches. There are no shortage of stories where someone delayed patching and then a vulnerability was exploited. Don't be that person. Work on getting your systems patched. Steve Jones - SSC Editor [Join the debate, and respond to the editorial on the forums](  The Weekly News All the headlines and interesting SQL Server information that we've collected over the past week, and sometimes even a few repeats if we think they fit. Vendors/3rd Party Products [Database Testing in a Flyway Development]( If you can test and evaluate databases, and database objects, at every phase of the database development lifecycle, then you are much more likely to be able to adopt continuous delivery. The further down the delivery pipeline that bugs appear, the more costly in time and resources they are to fix. [SQL Monitor supports Amazon RDS Monitoring]( SQL Monitor works with your SQL Server data, wherever that data exists, from local instances to AWS RDS and AWS virtual machines. You can keep an eye on your estate, regardless of where the data is. Administration of SQL Server [DBCC CHECKDB REPAIR_ALLOW_DATA_LOSS with Example]( From SQLServerCentral Blogs The T-SQL DBCC, acronym for “Database Console Command”, is a command that performs several types of tasks. These tasks are mainly of the validation and maintenance type. Some of the... The... [How To Read The SQL Server Error Log]( From Lee Markum   Reading the SQL Server Error Log is important when troubleshooting many issues for SQL Server. Some example issues would be errors related to Always On Availability Groups,... [Unrevealed tips of SQL Server Statistics]( From SQLShack In this article, we will explore some internal working principles of SQL Server statistics. What is Cardinality Estimator (CE)? The Cardinality Estimator (CE) is the core subunit of the... [Temporal: Encountering Error 13535 Data modification failed on system-versioned table...]( From MS SQL Server Blog When 2 or more workers are modifying the same row, it is possible to encounter 13535. The time of the begin transaction and the modification are the defining properties. ... Azure Databricks, Spark and Snowflake [Join through expression variable as on condition in databricks using PySpark]( Lets see how to join 2 table with a parameterized on condition in PySpark Azure SQL [Get up and running faster with the new post-database creation experience on the Azure Portal]( From Azure SQL The Azure SQL Database Portal team recently launch... Azure SQL Managed Instance [High Availability in Azure SQL MI: Business Critical service tier]( From Azure SQL In the first article High Availability in Azure SQL Managed Instance: General Purpose service tier we have described the principles behind the High Availability and dived into the specifics... Azure Synapse (SQL Data Warehouse and Data Lake) [What are the main tools for Azure Synapse and SQL???]( From Guy in a Cube Getting started with Azure Synapse Analytics or Az... Career, Employment, and Certifications [Google Suspends Engineer Who Claimed LaMDA AI Chatbot Is Sentient]( From Tom's Hardware US Google is quickly trying to squash any talk about LaMDA being sentient. Computing in the Cloud (Azure, Google, AWS) [Azure Storage Replication Types]( From SQLServerCentral Blogs Storage Accounts are pretty much integrated into s... [Azure CLI – Deleting Resources]( From SQLServerCentral Blogs Azure CLI is really handy for all sorts of tasks. When I build solutions, POCs and environments and I want to tear down the resources I like to use... The... [Azure SQL Managed Instance versus Amazon RDS for SQL Server—Which Should You Choose? (Or why Managed Instance is faster)]( From The SQL Herald (Joey D'Antoni) Microsoft, in conjunction with Principle Technologies recently produced a benchmark, comparing the performance of Azure SQL Managed Instance, and Amazon RDS SQL Server. I normally really dislike these benchmarks—it... [SQL Insider Series: SQL Migration tools, which one and when? | Data Exposed]( From Azure SQL In this episode of Data Exposed: SQL Insider Series, Anna Hoffman and Nadia Ben El Kadi review the main SQL Migration tools and explain which tool is best suited... [How to restore database using LTR backups with PowerShell]( From Azure Database Support Blog Lets review steps to restore an Azure SQL database... [Learning from Expertise#10: Why no restore point available?!]( From Azure Database Support Blog Introduction In today's blog article, we will try to address and clarify some points on how Azure SQL DB and Managed Instance Point in Time Restore (PiTR) works, especially when... Conferences, Classes, Events, and Webinars [Accelerating Digital Transformation: The role of DevOps and Data]( SQL Server Central Editor, Steve Jones is joined by a panel of industry experts from around the globe to discuss their experiences with digital transformation, and the impact it had on themselves, their teams and the wider organization. [Webinar: The role of Automation in Database DevOps]( Join Grant Fritchey to discover how automating your database deployments enables you to speed up software delivery with repeatable processes that stop your database being the bottleneck. [2021 Session video library available]( Want to get a flavor of the type of quality training sessions offered at PASS Data Community Summit? Dive into the full video library from Summit 2021 of over 250 sessions. Take your pick from sessions covering the following themes, Reach for the Clouds, Level Up and Back to Basics, presented by top data experts from around the world. [New CTE Course Release!]( From Steve Stedman One of the most overlooked features of SQL Server is the CTE which not only simplifies the query, but gives you the ability to do things that would otherwise... DMO/SMO/Powershell [3 Ways to Download a File in PowerShell]( From IT Pro - Microsoft Windows Information, Solutions, Tools PowerShell users can use the Invoke-Webrequest, Ne... [Opening your SQL Backup Folder using Powershell]( From SQL Undercover Sometimes I find remembering where a particular server sends its backups to a nightmare. You might have servers backing up to different locations, you might have different locations for... Data Privacy, Compliance, and Governance [Meta Sued Over Claims Patient Data Secretly Sent to Facebook]( From IT Pro - Microsoft Windows Information, Solutions, Tools The lawsuit alleges Facebook’s Pixel tracking tool redirects patient communications and other “secure” information without authorization. Database Design, Theory and Development [Combinations, permutations, and derangements]( Joe Celko explains how several mathematical concepts, combinations, permutations, and derangements, relate to databases [SMS: Order and Relational Databases]( From Database Debunkings Note: "Setting Matters Straight" is a new format: ... DevOps and Continuous Delivery (CI/CD) [The benefits of database change management]( Using a change management system for database code is a new idea for many database administrators. Grant Fritchey explains the many benefits of database change control. HA/DR/Always On/Clustering [Configure Distributed Availability Groups Between Failover Clusters on Different Active Directory Domains - Part 3]( From MSSQL Tips In this third article we continue building Distributed Availability Groups to migrate SQL Server databases to a different Active Directory domain. Hardware [Best Gaming Chairs 2022]( From Tom's Hardware US We rank the best gaming chairs from budget seats t... [Intel Debuts Meteor Lake Die, 'Intel 4' Node: 20% Higher Clocks at Same Power, 2X Area Scaling]( From Tom's Hardware US Intel debuted the details of its 'Intel 4' process... [HP Omen 27u Review: Slick Style And 144Hz 4K Performance]( From Tom's Hardware US HP’s Omen 27u is a 27-inch IPS Ultra HD monitor ... MDX/DAX [CLOSINGBALANCEMONTH, CLOSINGBALANCEQUARTER, CLOSINGBALANCEYEAR – DAX Guide]( From Sqlbi CLOSINGBALANCEMONTH: Evaluates the specified expression for the date corresponding to the end of the current month. CLOSINGBALANCEQUARTER: Evaluates the specified expression for the date corresponding to the end... [STARTOFMONTH, STARTOFQUARTER, STARTOFYEAR, ENDOFMONTH, ENDOFQUARTER, ENDOFYEAR – DAX Guide]( From Sqlbi STARTOFMONTH: Returns the start of month. STARTOFQUARTER: Returns the start of quarter. STARTOFYEAR: Returns the start of year. ENDOFMONTH: Returns the end of month. ENDOFQUARTER:... Microsoft News [Microsoft to Fix Windows Bug Breaking Wi-Fi hotspots After Installing Latest Patch Tuesday Update]( From Petri IT Knowledgebase Microsoft has acknowledged a new known issue causing the Wi-Fi... [Microsoft Lasers Music into Glass for 1000 Years of Storage]( From Tom's Hardware US Microsoft and Elire Group will use Project Silica ... [Microsoft Teams Now Lets Users Send Notes and Files to Themselves]( From Petri IT Knowledgebase Microsoft Teams is getting a new update that enables users... Oracle/PostgreSQL/MySQL/other RDBMS [Working with MySQL stored functions]( Stored functions in MySQL return a scalar value and can be used in a SQL statement. In this article, Robert Sheldon explains how to create and use a MySQL stored function. Performance Tuning SQL Server [SQL Server 2022 Finally Adds Actual Non Parallel Plan Reasons To Query Plans]( From Erik Darling Data Wayback Machine SQL Server query plans have had, forever, pretty generic reasons embedded in the XML for why your query was prevented from going parallel. Not for things like it not... [How to overcome parameter sniffing problems in ad-hoc queries]( From SQLShack The purpose of this article is to provide insights into how parameter sniffing occurs for an ad-hoc query and how it affects their performance. Case Study: Untouchable legacy code... PowerPivot/PowerQuery/PowerBI [Dynamic Page Navigation in Power BI]( From MSSQL Tips In this article we look at how to add custom page ... [Exporting a Power BI Visual data to a CSV File in SharePoint]( From FourMoo In this blog post I am going to demonstrate how to... [What tool do you use to optimize your Power BI dataset?]( From Guy in a Cube Need some help optimizing your Power BI Dataset bu... [Publish from Power BI Desktop for External Users]( From Guy in a Cube Have you ever wanted to publish from Power BI Desktop to a different organization? External Users publishing!!! Adam shows you how you can log in as an external user... [Power BI Field Parameters and Slowly Changing Dimensions]( From SQLServerCentral Blogs Power BI field parameters are a new feature in Power BI Desktop, and it’s one of the best of the past months. In short, Power BI field parameters allow... The... [Using SELECTEDVALUE with Fields Parameters in Power BI]( From Sqlbi If you try to use SELECTEDVALUE on the visible col... [How The “Maximum Connections Per Data Source” Property On Power BI DirectQuery Datasets Can Affect Report Performance]( From Chris Webb's BI Blog If you’re working with DirectQuery in Power BI then one of the most important properties you can set on your dataset is the “Maximum connections per data source” property.... Product Reviews and Articles [Another Way to Use SSIS Catalog Compare to Migrate SSIS Catalog Folders]( From AndyLeonard.blog() SSIS Catalog Compare 2022 (Beta) is available at ... [Refreshing Tables in Data Masker]( From SQLServerCentral Blogs Data Masker for SQL Server is a product that helps to change data for compliance purposes. It works well, but it isn’t intuitive in a few ways. We bought... The... Product Upgrades and Releases [General availability: Azure Data Explorer connector for Power Automate, Logic Apps, and Power Apps]( From Azure Updates Automate alerts, orchestrate business workflows an... [Gen4 hardware deprecation update impacting SQL database, SQL elastic pools and SQL Managed Instance]( From Azure SQL As announced on December 2019, After January 31st ... [Hotfix: Microsoft Drivers 5.10.1 for PHP for SQL Server Released]( From MS SQL Server Blog We recently released an update to Microsoft Driver... Python [Data Statistics and Analysis With Java and Python]( How to analyze tabular data using Java Streams and Python Pandas. As well as compare how they perform and scale for large amounts of data. R Language [Creating an Instant Answer Oracle with httr and Shiny]( Knowing how to write API requests and handle their responses is a valuable skill that a developer, data engineer or data analyst/scientist needs to know. In this short blog I share how its possible leverage DuckDuckGo’s instant answer API to create a oracle which can answer (some) of your questions using the httr package and Shiny. SQL Server News [Security Update for SQL Server 2014 SP3 GDR]( From MS SQL Server Blog The Security Update for SQL Server 2014 SP3 GDR is... [Security Update for SQL Server 2019 RTM CU16]( From MS SQL Server Blog The Security Update for SQL Server 2019 RTM CU16 i... [Security Update for SQL Server 2019 RTM GDR]( From MS SQL Server Blog The Security Update for SQL Server 2019 RTM GDR is... [Security Update for SQL Server 2017 RTM CU29]( From MS SQL Server Blog The Security Update for SQL Server 2017 RTM CU29 i... [Security Update for SQL Server 2017 RTM GDR]( From MS SQL Server Blog The Security Update for SQL Server 2017 RTM GDR is... [Security Update for SQL Server 2016 SP3 GDR]( From MS SQL Server Blog The Security Update for SQL Server 2016 SP3 GDR is... [Security Update for SQL Server 2016 SP2 CU17]( From MS SQL Server Blog The Security Update for SQL Server 2016 SP2 CU17 i... [Security Update for SQL Server 2016 SP2 GDR]( From MS SQL Server Blog The Security Update for SQL Server 2016 SP2 GDR is... [Security Update for SQL Server 2014 SP3 CU4]( From MS SQL Server Blog The Security Update for SQL Server 2014 SP3 CU4 is... SQL Server Security and Auditing [Who is Updating That Table? – SQL Audit]( From SQLServerCentral Blogs I had a problem at work recently where a record wa... SQL Server on Linux [How to Use Nohup to Run Linux Scripts Unattended]( From Tom's Hardware US Nohup is a command which prevents commands / scripts from stopping should we close a terminal window / SSH session. Security News and Issues [Atlassian Confluence Server Bug Under Active Attack to Distribute Ransomware]( From Dark Reading: Dark Reading News Analysis Most of the attacks involve the use of automated exploits, security vendor says. [A New Spin on a Classic Type of Social Engineering Attack]( From IT Pro - Microsoft Windows Information, Solutions, Tools As organizations get wise to common types of social engineering attacks, criminals are bound to get craftier. Here’s how a criminal could put a new spin on a classic... [3 Big Takeaways From the Verizon DBIR 2022]( From Dark Reading: Dark Reading News Analysis The annual report is always filled with useful security information. Here are several of the most important lessons from this year's edition. Software Development [T-SQL Tuesday 151 – T-SQL consistency and comments]( From Kevin Chant Reading Time: 2 minutes For this months T-SQL Tue... [T-SQL Tuesday #151 : Controversial Coding Conventions]( From SQLBlog.org I talk about why I prefer CONVERT over CAST to be ... [T-SQL Tuesday #151 – Coding standards]( From SQL Server Fast Edition #151 of T-SQL Tuesday is hosted by Mala Ma... [T-SQL Tuesday #151 – T-SQL Coding Standards]( From Glenn Berry Introduction This month’s T-SQL Tuesday is being... [T-SQL Tuesday #151 – Coding Standards]( From Deb the DBA It’s another T-SQL Tuesday! This month, Mala Mah... [Too many coding standards : T-SQL Tuesday #151]( From SQLStudies One of my favorite people, Malathi Mahadevan (blog... [T-SQL Tuesday #151 – T-SQL Coding Standards]( From Callihan Data This month’s T-SQL Tuesday invitation comes from... [The ROI of Build vs. Buy]( From Blog – Redgate Software I’ve written before about building your own moni... [How to Combine Branches with Git Merge]( From Petri IT Knowledgebase If you’re using Git for source code management, you may... [GitHub to Discontinue Atom Text Editor on December 15]( From Petri IT Knowledgebase Microsoft-owned GitHub is getting ready to retire Atom, an open-source... T-SQL and Query Languages [How to use DATE_BUCKET() Function in SQL Server]( The Date_Bucket function is introduced in Azure SQL Edge which is mainly used by IoT devices. This useful function returns the date-time value corresponding to the start of each date-time bucket from the timestamp defined by the origin parameter, or the default origin value of 1900-01-01 00:00:00.000. In other words, it lets you arrange data into groups that represent fixed intervals of time. SQL Server 2022 includes this useful function in its database engine. [Using a Regular Expression to Detect a Number–#SQLNewBlogger]( From SQLServerCentral Blogs Another post for me that is simple and hopefully s... [Introducing the MySQL SELECT statement]( From Simple Talk Use SELECT statements to query a MySQL database. In this article, Robert Sheldon explains how. … The post Introducing the MySQL SELECT statement appeared first on Simple Talk. [Basic SQL INSERT Statement with Examples]( From MSSQL Tips In this article learn about the basics of SQL INSERT statements along with several different examples of how to insert data into SQL Server tables. [Row Constructor in SQL Server Demo and Explanation]( From Steve Stedman Added to SQL Server in 2008 Steve explains and demonstrates how to set up row constructor. Transcription of video: So there’s this thing called a row constructor. And this... [When to use Azure Data Explorer]( Azure Data Explorer is a big data interactive analytics platform that empowers people to make data driven decisions in a highly agile environment. The factors listed below can help assess if Azure Data Explorer is a good fit for the workload at hand. These are the key questions to ask yourself. [SQL Server 2022: What The Heck Is sp_copy_data_in_batches?]( From Erik Darling Data Make It Or Not I’m gonna be honest with you, dear reader, because without honesty we’ve got nothing. Except lies — which you know — those can be comforting sometimes. Hm.... [Multiple CTE’s in a Query – Demo]( From Steve Stedman As a continuation from the day before, here is the multiple CTE’s in a query demo. Transcription of the demo: All right. So here’s an example of a simple... [How to use DATE_BUCKET() Function in SQL Server]( From Hasan Savran       The Date_Bucket function is introduced in Azure SQL Edge which is mainly used by IoT devices. This useful function returns the date-time value corresponding... [Fun With KQL – Distinct]( From Arcane Code Fun With KQL - Distinct Tools for Dev (SSMS, ADS, VS, etc.) [How to Import and Export Connections from SQL Server Management Studio]( From MSSQL Tips In this article we look at how to import and expor... [Notebook Views for SQL Notebooks in Azure Data Studio]( From SQLShack We are excited to share that Notebook Views are av... [What’s new with SQL Tools]( From Microsoft SQL Server Blog Hello community, the June release of Azure Data Studio 1.37 is here! We are also excited to announce the release of SQL Server Management Studio (SSMS) 18.12. In this...  [RSS Feed]([Twitter]( This email has been sent to {EMAIL}. To be removed from this list, please click [here](. If you have any problems leaving the list, please contact the webmaster@sqlservercentral.com. This newsletter was sent to you because you signed up at SQLServerCentral.com. Note: This is not the SQLServerCentral.com daily newsletter list, and unsubscribing to this newsletter will not stop you receiving the SQL Server Central daily newsletters. If you want to be removed from that list, you can follow the instructions on the daily newsletter. ©2019 Redgate Software Ltd, Newnham House, Cambridge Business Park, Cambridge, CB4 0WZ, United Kingdom. All rights reserved. webmaster@sqlservercentral.com  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -