Fixes for rel notes and added commits files
This commit is contained in:
parent
006d6c7bf7
commit
87202e08ef
4 changed files with 309 additions and 16 deletions
19
release-notes/2.1/2.1.7/2.1.7-commits.md
Normal file
19
release-notes/2.1/2.1.7/2.1.7-commits.md
Normal file
|
@ -0,0 +1,19 @@
|
||||||
|
# Commits to .NET Core 2.1.7 and .NET Core SDK 2.1.503
|
||||||
|
|
||||||
|
This is a curated list of commits across the .NET Core 2.1.7 development cycle.
|
||||||
|
|
||||||
|
* [CoreCLR](#coreclr)
|
||||||
|
* [CoreFX](#corefx)
|
||||||
|
* [AspNetCore](#aspnetcore)
|
||||||
|
|
||||||
|
## CoreCLR
|
||||||
|
|
||||||
|
* [`[a589a296f0]`](https://github.com/dotnet/coreclr/commit/a589a296f0) Port to 2.1 - Don't check for libintl.h on OSX (#20118)
|
||||||
|
* [`[e052c0341a]`](https://github.com/dotnet/coreclr/commit/e052c0341a) Formatting Japanese First Year of Era (#20729)
|
||||||
|
* [`[eb90b6c0f9]`](https://github.com/dotnet/coreclr/commit/eb90b6c0f9) Support new Japanese calendar eras (#20727)
|
||||||
|
|
||||||
|
## CoreFX
|
||||||
|
|
||||||
|
* [`[c50af3eee9]`](https://github.com/dotnet/corefx/commit/c50af3eee9) Fixes extract out of directory by ensuring trailing separator for nested paths. (#32165)
|
||||||
|
* [`[4b343d5324]`](https://github.com/dotnet/corefx/commit/4b343d5324) Allow transporting an indefinite-length encoding for content in SignedCms
|
||||||
|
* [`[5bc389f2f9]`](https://github.com/dotnet/corefx/commit/5bc389f2f9) Added additional OIDs for RSA-SSA-PKCS1.5 CMS signatures
|
|
@ -3,7 +3,7 @@
|
||||||
.NET Core 2.1.7 is available for [download](2.1.7-download.md) and usage in your environment. This release includes .NET Core 2.1.7, ASP.NET Core 2.1.7 and .NET Core SDK 2.1.503.
|
.NET Core 2.1.7 is available for [download](2.1.7-download.md) and usage in your environment. This release includes .NET Core 2.1.7, ASP.NET Core 2.1.7 and .NET Core SDK 2.1.503.
|
||||||
|
|
||||||
* [Downloads](#downloads)
|
* [Downloads](#downloads)
|
||||||
* [Changes in this release](#notable-changes-in-217)
|
* [Changes in this release](#changes-in-217)
|
||||||
* [Known Issues](../2.1-known-issues.md)
|
* [Known Issues](../2.1-known-issues.md)
|
||||||
|
|
||||||
Visit the [.NET Core blog][dotnet-blog] to read more about this release. Your feedback is important and appreciated. We've created an issue at [dotnet/core #XXXX](https://github.com/dotnet/core/issues/XXXX) for your questions and comments.
|
Visit the [.NET Core blog][dotnet-blog] to read more about this release. Your feedback is important and appreciated. We've created an issue at [dotnet/core #XXXX](https://github.com/dotnet/core/issues/XXXX) for your questions and comments.
|
||||||
|
@ -41,19 +41,137 @@ See [.NET Core Supported OS Lifecycle Policy](https://github.com/dotnet/core/blo
|
||||||
* Support for Fedora 27 has ended as of November 30, 2018.
|
* Support for Fedora 27 has ended as of November 30, 2018.
|
||||||
* Support for Fedora 29 has been added for .NET Core 2.1.
|
* Support for Fedora 29 has been added for .NET Core 2.1.
|
||||||
|
|
||||||
## Notable Changes in 2.1.7
|
## Changes in 2.1.7
|
||||||
|
.NET Core 2.1.7 release carries both security and non-security fixes, covering the listed vulnerabilites (see below CVEs), changes related to the addition of new era to the Japanese calendar and Cryptography related fixes. All fixes of note can be seen in the [2.1.7 commits](2.1.7-commits.md) list.
|
||||||
|
|
||||||
### [CVE-2019-0545: .NET Core Information Disclosure Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
* ### [CVE-2019-0545: .NET Core Information Disclosure Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
**Executive summary**
|
* ### [CVE-2019-0548: ASP.NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
### [CVE-2019-0548: .NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
Microsoft is releasing this security advisory to provide information about a vulnerability in public ASP.NET Core 1.0, 1.1 and 2.1. This advisory also provides guidance on what developers can do to update their applications correctly.
|
||||||
|
|
||||||
**Executive summary**
|
Microsoft is aware of a security vulnerability in all public versions of ASP.NET Core where, if an application is hosted on Internet Information Server (IIS) a remote unauthenticated attacker can use a specially crafted request can cause a Denial of Service.
|
||||||
|
|
||||||
### [CVE-2019-0564: .NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
* ### [CVE-2019-0564: ASP.NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
**Executive summary**
|
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and 2.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
|
||||||
|
|
||||||
|
Microsoft is aware of a denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
|
||||||
|
|
||||||
|
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application.
|
||||||
|
|
||||||
|
The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
|
||||||
|
|
||||||
|
**Package and Binary updates**
|
||||||
|
|
||||||
|
Package name | Vulnerable versions | Secure versions
|
||||||
|
------------ | ------------------- | -------------------------
|
||||||
|
Microsoft.AspNetCore.WebSockets | 2.2.0<br/>2.1.0, 2.1.1 | 2.2.1<br/>2.1.7
|
||||||
|
Microsoft.AspNetCore.Server.Kestrel.Core | 2.1.0, 2.1.1, 2.1.2, 2.1.3 | 2.1.7
|
||||||
|
System.Net.WebSockets.WebSocketProtocol | 4.5.0, 4.5.1, 4.5.2 | 4.5.3
|
||||||
|
Microsoft.NETCore.App | 2.2.0<br/>2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.2.1 <br/> 2.1.7
|
||||||
|
Microsoft.AspNetCore.App | 2.2.0<br/>2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.2.1 <br/> 2.1.7
|
||||||
|
Microsoft.AspNetCore.All | 2.2.0<br/>2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.2.1 <br/> 2.1.7
|
||||||
|
|
||||||
|
* ### [CVE-2018-8416: .NET Core Tampering Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
|
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
|
||||||
|
|
||||||
|
Microsoft is aware of a tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories.
|
||||||
|
|
||||||
|
To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system
|
||||||
|
|
||||||
|
The update addresses the vulnerability by correcting how .NET Core handles these files.
|
||||||
|
|
||||||
|
**Package and Binary updates**
|
||||||
|
Package name | Vulnerable versions | Secure versions
|
||||||
|
------------ | ------------------- | -------------------------
|
||||||
|
System.IO.Compression.ZipFile | 4.0.0, 4.0.1, 4.3.0 | 4.3.1
|
||||||
|
|
||||||
|
## Packages updated as part of this release:
|
||||||
|
Package name | Version
|
||||||
|
------------ | -------------------
|
||||||
|
dotnet-aspnet-codegenerator | 2.1.7
|
||||||
|
Microsoft.AspNetCore | 2.1.7
|
||||||
|
Microsoft.AspNetCore.All | 2.1.7
|
||||||
|
Microsoft.AspNetCore.App | 2.1.7
|
||||||
|
Microsoft.AspNetCore.Server.IISIntegration | 2.1.7
|
||||||
|
Microsoft.AspNetCore.Server.Kestrel.Core | 2.1.7
|
||||||
|
Microsoft.AspNetCore.WebSockets | 2.1.7
|
||||||
|
Microsoft.NETCore.App | 2.1.7
|
||||||
|
Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Contracts | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Core | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Design | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.EntityFrameworkCore | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Templating | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Utils | 2.1.7
|
||||||
|
Microsoft.VisualStudio.Web.CodeGenerators.Mvc | 2.1.7
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.win-arm.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.win-x64.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
runtime.win-x86.Microsoft.NETCore.App | 2.1.7
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetAppHost | 2.1.7
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetHost | 2.1.7
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy | 2.1.7
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetHostResolver | 2.1.7
|
||||||
|
System.IO.Pipelines | 4.5.3
|
||||||
|
System.Memory | 4.5.2
|
||||||
|
System.Net.Http.WinHttpHandler | 4.5.2
|
||||||
|
System.Net.WebSockets.WebSocketProtocol | 4.5.3
|
||||||
|
System.Security.Cryptography.Pkcs | 4.5.2
|
||||||
|
System.Text.Encoding.CodePages | 4.5.1
|
||||||
|
System.Threading.Tasks.Extensions | 4.5.2
|
||||||
|
|
||||||
[blob-runtime]: https://dotnetcli.blob.core.windows.net/dotnet/Runtime/
|
[blob-runtime]: https://dotnetcli.blob.core.windows.net/dotnet/Runtime/
|
||||||
[blob-sdk]: https://dotnetcli.blob.core.windows.net/dotnet/Sdk/
|
[blob-sdk]: https://dotnetcli.blob.core.windows.net/dotnet/Sdk/
|
||||||
|
|
21
release-notes/2.2/2.2.1/2.2.1-commits.md
Normal file
21
release-notes/2.2/2.2.1/2.2.1-commits.md
Normal file
|
@ -0,0 +1,21 @@
|
||||||
|
# Commits to .NET Core 2.2.1 and .NET Core SDK 2.2.102
|
||||||
|
|
||||||
|
This is a curated list of commits across the .NET Core 2.2.1 development cycle.
|
||||||
|
|
||||||
|
* [CoreCLR](#coreclr)
|
||||||
|
* [CoreFX](#corefx)
|
||||||
|
* [AspNetCore](#aspnetcore)
|
||||||
|
|
||||||
|
## CoreCLR
|
||||||
|
|
||||||
|
* [`[b24eee89da]`](https://github.com/dotnet/coreclr/commit/b24eee89da) Fix CancellationTokenRegistration.Token after CTS.Dispose (#21417)
|
||||||
|
* [`[18a57b3a84]`](https://github.com/dotnet/coreclr/commit/18a57b3a84) Fix "LTTng-UST: Error (-17) while registering..." error when debugging (20874) (#21218)
|
||||||
|
* [`[470d299811]`](https://github.com/dotnet/coreclr/commit/470d299811) Port fix value numbering when selecting a constant to release/2.2
|
||||||
|
* [`[1e647b10ab]`](https://github.com/dotnet/coreclr/commit/1e647b10ab) Added support for running in a sandbox on Mac (#20735) (#20906)
|
||||||
|
* [`[a589a296f0]`](https://github.com/dotnet/coreclr/commit/a589a296f0) Port to 2.1 - Don't check for libintl.h on OSX (#20118)
|
||||||
|
* [`[e052c0341a]`](https://github.com/dotnet/coreclr/commit/e052c0341a) Formatting Japanese First Year of Era (#20729)
|
||||||
|
* [`[eb90b6c0f9]`](https://github.com/dotnet/coreclr/commit/eb90b6c0f9) Support new Japanese calendar eras (#20727)
|
||||||
|
|
||||||
|
## CoreFX
|
||||||
|
|
||||||
|
* [`[8268b1acc6]`](https://github.com/dotnet/corefx/commit/8268b1acc6) QueryDirectoryFile requires 64 bit alignment to work on ARM32. (#33713) (#33754)
|
|
@ -3,7 +3,7 @@
|
||||||
.NET Core 2.2.1 is available for [download](2.2.1-download.md) and usage in your environment. This release includes .NET Core 2.2.1, ASP.NET Core 2.2.1 and .NET Core SDK 2.2.102.
|
.NET Core 2.2.1 is available for [download](2.2.1-download.md) and usage in your environment. This release includes .NET Core 2.2.1, ASP.NET Core 2.2.1 and .NET Core SDK 2.2.102.
|
||||||
|
|
||||||
* [Downloads](#downloads)
|
* [Downloads](#downloads)
|
||||||
* [Changes in this release](#notable-changes-in-221)
|
* [Changes in this release](#changes-in-221)
|
||||||
* [Known Issues](../2.1-known-issues.md)
|
* [Known Issues](../2.1-known-issues.md)
|
||||||
|
|
||||||
Visit the [.NET Core blog][dotnet-blog] to read more about this release. Your feedback is important and appreciated. We've created an issue at [dotnet/core #XXXX](https://github.com/dotnet/core/issues/XXXX) for your questions and comments.
|
Visit the [.NET Core blog][dotnet-blog] to read more about this release. Your feedback is important and appreciated. We've created an issue at [dotnet/core #XXXX](https://github.com/dotnet/core/issues/XXXX) for your questions and comments.
|
||||||
|
@ -41,19 +41,154 @@ See [.NET Core Supported OS Lifecycle Policy](https://github.com/dotnet/core/blo
|
||||||
* Support for Fedora 27 has ended as of November 30, 2018.
|
* Support for Fedora 27 has ended as of November 30, 2018.
|
||||||
* Support for Fedora 29 has been added for .NET Core 2.2.
|
* Support for Fedora 29 has been added for .NET Core 2.2.
|
||||||
|
|
||||||
## Notable Changes in 2.2.1
|
## Changes in 2.2.1
|
||||||
|
.NET Core 2.2.1 release carries both security and non-security fixes, covering the listed vulnerabilites (see CVEs below), changes related to the addition of new era to the Japanese calendar, support for running in a sandbox on Mac, and several other reliability fixes. All fixes of note can be seen in the [2.2.1 commits](2.2.1-commits.md) list.
|
||||||
|
|
||||||
### [CVE-2019-0545: .NET Core Information Disclosure Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
* ### [CVE-2019-0545: .NET Core Information Disclosure Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
* ### [CVE-2019-0548: ASP.NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
**Executive summary**
|
Microsoft is releasing this security advisory to provide information about a vulnerability in public ASP.NET Core 1.0, 1.1 and 2.1. This advisory also provides guidance on what developers can do to update their applications correctly.
|
||||||
|
|
||||||
### [CVE-2019-0548: .NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
Microsoft is aware of a security vulnerability in all public versions of ASP.NET Core where, if an application is hosted on Internet Information Server (IIS) a remote unauthenticated attacker can use a specially crafted request can cause a Denial of Service.
|
||||||
|
|
||||||
**Executive summary**
|
* ### [CVE-2019-0564: ASP.NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
### [CVE-2019-0564: .NET Core Denial Of Service Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and 2.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
|
||||||
|
|
||||||
**Executive summary**
|
Microsoft is aware of a denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.
|
||||||
|
|
||||||
|
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application.
|
||||||
|
|
||||||
|
The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.
|
||||||
|
|
||||||
|
**Package and Binary updates**
|
||||||
|
|
||||||
|
Package name | Vulnerable versions | Secure versions
|
||||||
|
------------ | ------------------- | -------------------------
|
||||||
|
Microsoft.AspNetCore.WebSockets | 2.2.0<br/>2.1.0, 2.1.1 | 2.2.1<br/>2.1.7
|
||||||
|
Microsoft.AspNetCore.Server.Kestrel.Core | 2.1.0, 2.1.1, 2.1.2, 2.1.3 | 2.1.7
|
||||||
|
System.Net.WebSockets.WebSocketProtocol | 4.5.0, 4.5.1, 4.5.2 | 4.5.3
|
||||||
|
Microsoft.NETCore.App | 2.2.0<br/>2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.2.1 <br/> 2.1.7
|
||||||
|
Microsoft.AspNetCore.App | 2.2.0<br/>2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.2.1 <br/> 2.1.7
|
||||||
|
Microsoft.AspNetCore.All | 2.2.0<br/>2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.2.1 <br/> 2.1.7
|
||||||
|
|
||||||
|
* ### [CVE-2018-8416: .NET Core Tampering Vulnerability](https://github.com/dotnet/Announcements/issues/XX)
|
||||||
|
**Executive summary**
|
||||||
|
|
||||||
|
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
|
||||||
|
|
||||||
|
Microsoft is aware of a tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories.
|
||||||
|
|
||||||
|
To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system
|
||||||
|
|
||||||
|
The update addresses the vulnerability by correcting how .NET Core handles these files.
|
||||||
|
|
||||||
|
**Package and Binary updates**
|
||||||
|
Package name | Vulnerable versions | Secure versions
|
||||||
|
------------ | ------------------- | -------------------------
|
||||||
|
System.IO.Compression.ZipFile | 4.0.0, 4.0.1, 4.3.0 | 4.3.1
|
||||||
|
|
||||||
|
## Packages updated as part of this release:
|
||||||
|
|
||||||
|
Package name | Version
|
||||||
|
------------ | -------------------
|
||||||
|
dotnet-aspnet-codegenerator | 2.2.1
|
||||||
|
dotnet-ef | 2.2.1
|
||||||
|
Microsoft.AspNetCore.All | 2.2.1
|
||||||
|
Microsoft.AspNetCore.App | 2.2.1
|
||||||
|
Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore | 2.2.1
|
||||||
|
Microsoft.AspNetCore.Server.IIS | 2.2.1
|
||||||
|
Microsoft.AspNetCore.Server.IISIntegration | 2.2.1
|
||||||
|
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets | 2.2.1
|
||||||
|
Microsoft.AspNetCore.WebSockets | 2.2.1
|
||||||
|
Microsoft.Data.Sqlite | 2.2.1
|
||||||
|
Microsoft.Data.Sqlite.Core | 2.2.1
|
||||||
|
Microsoft.DotNet.Web.Client.ItemTemplates | 2.2.1
|
||||||
|
Microsoft.DotNet.Web.ItemTemplates | 2.2.1
|
||||||
|
Microsoft.DotNet.Web.ProjectTemplates.2.2 | 2.2.1
|
||||||
|
Microsoft.DotNet.Web.Spa.ProjectTemplates | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Abstractions | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Analyzers | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Design | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.InMemory | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Proxies | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Relational | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Relational.Specification.Tests | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Specification.Tests | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Sqlite | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Sqlite.Core | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Sqlite.NetTopologySuite | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.SqlServer | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.SqlServer.NetTopologySuite | 2.2.1
|
||||||
|
Microsoft.EntityFrameworkCore.Tools | 2.2.1
|
||||||
|
Microsoft.NETCore.App | 2.2.1
|
||||||
|
Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Contracts | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Core | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Design | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.EntityFrameworkCore | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Templating | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGeneration.Utils | 2.2.1
|
||||||
|
Microsoft.VisualStudio.Web.CodeGenerators.Mvc | 2.2.1
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.win-arm.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.win-arm.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.win-x64.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.win-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
runtime.win-x86.Microsoft.NETCore.App | 2.2.1
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetAppHost | 2.2.1
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetHost | 2.2.1
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy | 2.2.1
|
||||||
|
runtime.win-x86.Microsoft.NETCore.DotNetHostResolver | 2.2.1
|
||||||
|
System.Net.WebSockets.WebSocketProtocol | 4.5.3
|
||||||
|
|
||||||
|
|
||||||
[blob-runtime]: https://dotnetcli.blob.core.windows.net/dotnet/Runtime/
|
[blob-runtime]: https://dotnetcli.blob.core.windows.net/dotnet/Runtime/
|
||||||
|
|
Loading…
Reference in a new issue