Microsoft Security Advisory 4021279: Microsoft is releasing this security advisory to provide information about vulnerabilities in public .NET Core and ASP.NET Core. This advisory also provides guidance on what developers can do to update their applications correctly.
.NET Core & ASP.NET Core are the next generation of .NET that provide a familiar and modern framework for web and cloud scenarios. These products are actively developed by the .NET and ASP.NET team in collaboration with a community of open source developers, running on Windows, Mac OS X and Linux. When .NET Core was released, the version number was reset to 1.0.0 to reflect the fact that it is a separate product from its predecessor -.NET.
The vulnerabilities affect any Microsoft .NET Core project if it uses any of the listed affected package versions. These include System.Text.Encodings.Web, System.Net.Http, System.Net.Security and Microsoft.AspNetCore.Mvc.
How do I know if I am affected?
.NET Core and ASP.NET Core have two types of dependencies: direct and transitive. If your project has a direct or transitive dependency on any of the packages and versions listed above, you are affected.
Note: As part of patching ASP.NET Core MVC we update every Microsoft.AspNetCore.Mvc.* package. If, for example, you have a dependency on
Microsoft.AspNetCore.Mvc you should update to the appropriate version first (1.0.x should be updated to 1.0.4, 1.1.x should be updated to 1.1.3), and it will also update any other vulnerable
If you want to step in to help me cover the costs for running this website, that would be awesome. Just use this link to donate a cup of coffee ($5 USD for example). And please share the love and help others make use of this website. Thank you very much!
My name is Jan. I am not a hacker, coder, developer, programmer or guru. I am merely a system administrator, doing my daily thing at Vevida in the Netherlands. With over 15 years of experience, my specialties include Windows Server, IIS, Linux (CentOS, Debian), security, PHP, websites & optimization.
How to: Determine which .NET Framework versions are installed
Threads in C#
.NET Framework 4.6 allows side loading of Windows API Set DLL
Remove IIS Server version HTTP Response Header
How to: Test MySQL database connectivity in ASP.NET, PHP, ASP
Add (custom) headers to MailMessage class