Microsoft Security Advisory 4021279: Microsoft is releasing this security advisory to provide information about vulnerabilities in public .NET Core and ASP.NET Core. This advisory also provides guidance on what developers can do to update their applications correctly.
.NET Core & ASP.NET Core are the next generation of .NET that provide a familiar and modern framework for web and cloud scenarios. These products are actively developed by the .NET and ASP.NET team in collaboration with a community of open source developers, running on Windows, Mac OS X and Linux. When .NET Core was released, the version number was reset to 1.0.0 to reflect the fact that it is a separate product from its predecessor -.NET.
The vulnerabilities affect any Microsoft .NET Core project if it uses any of the listed affected package versions. These include System.Text.Encodings.Web, System.Net.Http, System.Net.Security and Microsoft.AspNetCore.Mvc.
How do I know if I am affected?
.NET Core and ASP.NET Core have two types of dependencies: direct and transitive. If your project has a direct or transitive dependency on any of the packages and versions listed above, you are affected.
Note: As part of patching ASP.NET Core MVC we update every Microsoft.AspNetCore.Mvc.* package. If, for example, you have a dependency on
Microsoft.AspNetCore.Mvc you should update to the appropriate version first (1.0.x should be updated to 1.0.4, 1.1.x should be updated to 1.1.3), and it will also update any other vulnerable