.NET Core April 2019 Updates – 2.1.10 and 2.2.4

Vivek Mishra

April 9th, 20192 0

Today, we are releasing the .NET Core April 2019 Update. These updates contain security and reliability fixes. See the individual release notes for details on included fixes.

Security

Microsoft Security Advisory CVE-2019-0815: ASP.NET Core Denial of Service Vulnerability

A denial of service vulnerability exists in ASP.NET Core 2.2 where, if an application is hosted on Internet Information Server (IIS) a remote unauthenticated attacker can use a specially crafted request to cause a Denial of Service.

The vulnerability affects any Microsoft ASP.NET Core 2.2 applications if it is hosted on an IIS server running AspNetCoreModuleV2 (ANCM) prior to and including 12.2.19024.2. The security update addresses the vulnerability by ensuring the IIS worker process does not crash in response to specially crafted requests.

Getting the Update

The latest .NET Core updates are available on the .NET Core download page.

See the .NET Core release notes ( 2.1.10 | 2.2.4 ) for details on the release including a issues fixed and affected packages.

Docker Images

.NET Docker images have been updated for today’s release. The following repos have been updated.

microsoft/dotnet microsoft/dotnet-samples microsoft/aspnetcore

Note: Look at the “Tags” view in each repository to see the updated Docker image tags.

Note: You must re-pull base images in order to get updates. The Docker client does not pull updates automatically.

Azure App Services deployment

Deployment of these updates Azure App Services has been scheduled and they estimate the deployment will be complete by Apr 23, 2019.

Vivek Mishra Senior Program Manager, .NET

Read next

.NET Core Workers in Azure Container Instances
In .NET Core 3.0 we are introducing a new type of application template called Worker Service. This template is intended to give you a starting point for writing long running services in .NET Core. In this walkthrough you'll learn how to use a Worker with Azure Container Registry anAzure Container Instances to get your Worker running as a microservice in the cloud.
Brady Gaster
April 15, 2019
22 comments

2 comments

Discussion is closed. Login to edit/delete existing comments.

  • Wells Fargo 0

    Hello, I am part of patch analyst who search details for your latest released of patch version. I would like to seek your confirmation regarding versions .Net SDK Core 2.1.506 and .Net SDK Core 2.1.603 if we have vulnerability or CVE for those patch versions. Please confirm also if that patch version is a security or non security patch. Based on your released notes .Net Core SDK 2.1.10 release carries both security and non-security fixes. Please advise regarding this concern and thank you in advance for your help.

Feedback usabilla icon