.NET Core November 2017 Update

Today, we are releasing the .NET Core November Update. This includes .NET Core 1.0.8, 1.1.5 and 2.0.1 and .NET Core SDK 1.1.5 and 2.0.3.

Details regarding the security issues addressed by this release can be seen in the Security Advisory announcement.

Security

CVE-2017-8585 — Malformed Certificate can cause Denial of Service

Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of .NET Core 1.0 and 1.1, and 2.0. This advisory also provides guidance on what developers can do to update their applications correctly.

Microsoft is aware of a security vulnerability in the public version of .NET Core where a malformed certificate or other ASN.1 formatted data could lead to a denial of service via an infinite loop on Linux and macOS.

System administrators are advised to update their .NET Core runtimes to versions 1.0.8, 1.1.5 and 2.0.1. Developers are advised to update their .NET Core SDK to version 2.0.3 or 1.1.5.

CVE-2017-8585

Quality

See the release notes for a list of all the quality fixes in this release.

Getting the Update

The .NET Core November 2017 Update is available from the .NET Core download page.

You can always download the version of .NET Core at .NET Downloads.

Docker Images

.NET Docker images have been updated for today’s release. The following repos have been updated.

microsoft/dotnet

The following repos are in the process of being updated:

Note: Look at the “Tags” view in each repository to see the updated Docker image tags.

Note: You must re-pull base images in order to get updates. The Docker client does not pull updates automatically.

Note: The Windows Docker tag scheme has changed.

Previous .NET Core Updates

The last few .NET Core updates follow:

Author

Rich Lander [MSFT]

Program Manager

Richard Lander is a Principal Program Manager on the .NET Core team. He works on making .NET Core work great in memory-limited Docker containers, on ARM hardware like the Raspberry Pi, and enabling GPIO programming and IoT scenarios. He is part of the design team that defines new .NET runtime capabilities and features. He enjoys British rock and Doctor Who. He grew up in Canada and New Zealand.