Your feedback is important and appreciated. We've created [dotnet/core #1082](https://github.com/dotnet/core/issues/1082) for your questions and comments.
Deployment of the November 2017 Update on Azure AppServices is in process. Because AppServices is a high availability service, the deployment is carefully staged across regions over a period of time. Availability will begin in the West US 2 region today and gradually expand to all regions over the next few days.
Microsoft is releasing security advisories for .NET Core and ASP.NET Core. Details can be found in corresponding announcements in the [.NET Core](https://github.com/dotnet/announcements) and [ASP.NET Core](https://github.com/aspnet/announcements) repos.
#### CVE-2017-8585 Malformed Certificate can cause Denial of Service
Microsoft is aware of a security vulnerability in .NET Core 1.0, 1.1 and 2.0 where a malformed certificate or other ASN.1 formatted data could lead to a denial of service via an infinite loop on Linux and macOS.
System administrators are advised to update their .NET Core runtimes to versions 1.0.8, 1.1.5 and 2.0.1. Developers are advised to update their .NET Core SDK to version 2.0.3 or 1.1.5.
#### CVE-2017-8700 CORS bypass can enable Information Disclosure
Microsoft is aware of a security vulnerability in ASP.NET Core 1.0 and 1.1 where Cross-Origin Resource Sharing (CORS) can be bypassed, leading to information disclosure.
#### CVE-2017-11879: Open Redirect can cause Elevation Of Privilege
Microsoft is aware of a security vulnerability in ASP.NET Core 2.0 where an Open Redirect exists, leading to Elevation Of Privilege.
#### CVE-2017-11770: Denial Of Service Vulnerability
Microsoft is aware of a security vulnerability in ASP.NET Core 1.0, 1.1 and 2.0 where the application is hosted through Windows Http.Sys where a malformed request can lead to a Denial Of Service.
The [.NET Core Docker images](https://hub.docker.com/r/microsoft/dotnet/) have been updated for this release. Look for the 1.1.5 images.
## Fixes in the November 2017 Update
### 1.0.8
## CoreCLR
* [`[54f1cf6]`](https://github.com/dotnet/coreclr/commit/54f1cf6) Port to 1.0.0 - Fix passing struct with four floats in registers via reflection (#14392)
* [`[88f43c3]`](https://github.com/dotnet/corefx/commit/88f43c3) Remove EOL'd OS's openSuSE 13.2 and Fedora 23 have been EOL'd and are no longer usable/upgradeable in CI. (#23621)
* [`[ec5640f]`](https://github.com/dotnet/corefx/commit/ec5640f) Fix handling of flock in FileStream on Unix (#23235)
* [`[e13c1b0]`](https://github.com/dotnet/corefx/commit/e13c1b0) Packaging updates to service X509Certificates
* [`[47d95a6]`](https://github.com/dotnet/corefx/commit/47d95a6) Simplify X509Chain building with OpenSSL
* [`[a077f83]`](https://github.com/dotnet/corefx/commit/a077f83) add apfs introduced by OSX 10.13
* [`[3af071c]`](https://github.com/dotnet/corefx/commit/3af071c) Prevent crash when Openssl's PKCS12_parse function fails.
### 1.1.5
## CoreCLR
* [`[2820bd8]`](https://github.com/dotnet/coreclr/commit/2820bd8) Convert literals to hex literals in k-nucleotide-9
