.NET January 2021 Updates – 5.0.2, 3.1.11, 2.1.24

Today, we are releasing the .NET January 2021 Updates. These updates contains reliability and security improvements. See the individual release notes for details on updated packages.

You can download 5.0.2 , 3.1.11, 2.1.24 versions for Windows, macOS, and Linux, for x86, x64, Arm32, and Arm64.

Installers and binaries: 5.0.2 | 3.1.11 | 2.1.24
Release notes: 5.0.2 | 3.1.11 | 2.1.24
Container images
Linux packages: 5.0.2 | 3.1.11 | 2.1.24
Release feedback/issues
Known issues: 5.0 | 3.1 | 2.1

Security

CVE-2021-1723: ASP.NET Core Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core and ASP.NET 5. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests.

Improvements

Visual Studio

See release notes for Visual Studio compatibility for .NET Core 2.1 and .NET Core 3.1 and .NET 5.0.

.NET Core 2.1 End of life

.NET Core 2.1 will reach end of life on August 21, 2021, as described in .NET Releases and per .NET Release Policies. After that time, .NET Core 2.1 patch updates will no longer be provided. We recommend that you move any .NET Core 2.1 applications and environments to .NET Core 3.1 in first half of 2021. It’ll be an easy upgrade in most cases.

This update of .NET Core 2.1 is the last update for .NET Core 2.1.6xx SDK since Visual Studio 16.0 is out of support as of January 2021. We will continue to update versions 2.1.5xx and 2.1.8xx until .NET Core 2.1 reaches end of life.

The .NET Releases page is the best place to look for release lifecycle information. Knowing key dates helps you make informed decisions about when to upgrade or make other changes to your software and computing environment.

OS Lifecycle update

RHEL 6 has reached end of life as of November 2020. The operating system support pages for .NET Core 2.1 and .NET Core 3.1 have been updated to reflect that RHEL 6 is no longer supported.

3 comments

Mike M January 21, 2021

@Rahul when we can expect .NET Core 3.1.11 runtime to be default version on Azure (App/Functions Services)?

As of now, Azure is on old 3.1.8 version

Rahul Bhandari (MSFT) Author January 21, 2021 0

Hello, The Azure App Services team is currently rolling out the new updates and they are expected to be available by end of January