{"id":28638,"date":"2020-06-09T10:30:19","date_gmt":"2020-06-09T17:30:19","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/dotnet\/?p=28638"},"modified":"2020-06-10T12:20:08","modified_gmt":"2020-06-10T19:20:08","slug":"net-core-june-2020-updates-2-1-19-and-3-1-5","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/net-core-june-2020-updates-2-1-19-and-3-1-5\/","title":{"rendered":".NET Core June 2020 Updates \u2013 2.1.19 and 3.1.5"},"content":{"rendered":"<p>Today, we are releasing the .NET Core June 2020 Update. These updates contain security and reliability fixes. See the individual release notes for details on updated packages.<\/p>\n<h2 id=\"security\">Security<\/h2>\n<div>\n<h3><a href=\"https:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/CVE-2020-1108\">CVE-2020-1108: .NET Core Denial of Service Vulnerability<\/a><\/h3>\n<div style=\"text-align: left;\">\n<div>\n<p>To comprehensively address CVE-2020-1108, Microsoft has released updates for .NET Core 2.1 and .NET Core 3.1<span style=\"font-size: 1rem;\" data-contrast=\"none\">. <\/span><span style=\"font-size: 1rem;\">Customers who use any of these versions of .NET Core should install the latest version of .NET Core. See the <a href=\"https:\/\/github.com\/dotnet\/announcements\/issues\/157\">Release Notes<\/a> for the latest version numbers and instructions for updating .NET Core.<\/span><\/p>\n<p><span style=\"font-size: 1rem;\" data-contrast=\"none\">Microsoft is aware of a denial of service vulnerability which exists when .NET <span style=\"font-size: 12pt;\">Core<\/span> improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core web application. The vulnerability can be exploited remotely, without authentication.<\/span><span style=\"font-size: 1rem;\" data-ccp-props=\"{&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application.<\/span><span data-ccp-props=\"{&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><span data-contrast=\"none\">The update addresses the vulnerability by correcting how the .NET Core web application handles web requests.<\/span><span data-ccp-props=\"{&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<\/div>\n<div><\/div>\n<\/div>\n<\/div>\n<h2>Getting the Update<\/h2>\n<ul>\n<li>.NET Core 3.1.5 and .NET Core SDK ( <a href=\"https:\/\/www.microsoft.com\/net\/download\/dotnet-core\/3.1\">Download<\/a> | <a href=\"https:\/\/github.com\/dotnet\/core\/blob\/master\/release-notes\/3.1\/3.1.5\/3.1.5.md\">Release Notes<\/a> )<\/li>\n<li>.NET Core 2.1.19 and .NET Core SDK ( <a href=\"https:\/\/www.microsoft.com\/net\/download\/dotnet-core\/2.1\">Download<\/a> | <a href=\"https:\/\/github.com\/dotnet\/core\/blob\/master\/release-notes\/2.1\/2.1.19\/2.1.19.md\">Release Notes<\/a> )<\/li>\n<\/ul>\n<p><span class=\"TextRun SCXW205244410 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW205244410 BCX0\">See the .NET Core release notes for details on the release, including issues fixed and affected packages.<\/span><\/span><span class=\"EOP SCXW205244410 BCX0\" data-ccp-props=\"{&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<p>The latest .NET Core updates are available on the <a href=\"https:\/\/www.microsoft.com\/net\/download\/all\">.NET Core download page<\/a>.<\/p>\n<h2>Docker Images<\/h2>\n<p>.NET Docker images have been updated for today\u2019s release. The following repos have been updated.<\/p>\n<ul>\n<li><a href=\"https:\/\/hub.docker.com\/_\/microsoft-dotnet-core-sdk\/\">dotnet\/core\/sdk<\/a>: .NET Core SDK<\/li>\n<li><a href=\"https:\/\/hub.docker.com\/_\/microsoft-dotnet-core-aspnet\/\">dotnet\/core\/aspnet<\/a>: ASP.NET Core Runtime<\/li>\n<li><a href=\"https:\/\/hub.docker.com\/_\/microsoft-dotnet-core-runtime\/\">dotnet\/core\/runtime<\/a>: .NET Core Runtime<\/li>\n<li><a href=\"https:\/\/hub.docker.com\/_\/microsoft-dotnet-core-runtime-deps\/\">dotnet\/core\/runtime-deps<\/a>: .NET Core Runtime Dependencies<\/li>\n<li><a href=\"https:\/\/hub.docker.com\/_\/microsoft-dotnet-core-samples\/\">dotnet\/core\/samples<\/a>: .NET Core Samples<\/li>\n<\/ul>\n<p><strong>Note:<\/strong> You must pull updated .NET Core container images to get this update, with either <code>docker pull<\/code> or <code>docker build --pull<\/code>.<\/p>\n<div>\n<div style=\"text-align: left;\">\n<div><\/div>\n<\/div>\n<div>\n<h2 aria-level=\"2\">Visual Studio<span data-ccp-props=\"{&quot;134233117&quot;:true,&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"none\">This update will be included in a future update of Visual Studio.<\/span><span data-ccp-props=\"{&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Each version of Visual studio is only supported with a given version of the\u00a0<\/span><span data-contrast=\"none\">.NET Core SDK.\u00a0<\/span><span data-contrast=\"none\">Visual Studio version information is included in the .NET Core SDK\u00a0<\/span><span data-contrast=\"none\">download page<\/span><span data-contrast=\"none\">s and release notes<\/span><span data-contrast=\"none\">.<\/span><span data-contrast=\"none\">\u00a0<\/span><span data-contrast=\"none\">If you\u00a0<\/span><span data-contrast=\"none\">are not using Visual Studio<\/span><span data-contrast=\"none\">, we recommend using the latest SDK release.<\/span><span data-ccp-props=\"{&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559739&quot;:160,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<\/div>\n<\/div>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today, we are releasing the .NET Core June 2020 Update. These updates contain security and reliability fixes. See the individual release notes for details on updated packages. Security CVE-2020-1108: .NET Core Denial of Service Vulnerability To comprehensively address CVE-2020-1108, Microsoft has released updates for .NET Core 2.1 and .NET Core 3.1. Customers who use any [&hellip;]<\/p>\n","protected":false},"author":7455,"featured_media":58792,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[685],"tags":[],"class_list":["post-28638","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dotnet"],"acf":[],"blog_post_summary":"<p>Today, we are releasing the .NET Core June 2020 Update. These updates contain security and reliability fixes. See the individual release notes for details on updated packages. Security CVE-2020-1108: .NET Core Denial of Service Vulnerability To comprehensively address CVE-2020-1108, Microsoft has released updates for .NET Core 2.1 and .NET Core 3.1. Customers who use any [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts\/28638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/users\/7455"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/comments?post=28638"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts\/28638\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/media\/58792"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/media?parent=28638"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/categories?post=28638"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/tags?post=28638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}