Today, we are releasing the .NET Core November Update. This includes .NET Core 1.0.8, 1.1.5 and 2.0.1 and .NET Core SDK 1.1.5 and 2.0.3.
Details regarding the security issues addressed by this release can be seen in the Security Advisory announcement.
Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of .NET Core 1.0 and 1.1, and 2.0. This advisory also provides guidance on what developers can do to update their applications correctly.
Microsoft is aware of a security vulnerability in the public version of .NET Core where a malformed certificate or other ASN.1 formatted data could lead to a denial of service via an infinite loop on Linux and macOS.
System administrators are advised to update their .NET Core runtimes to versions 1.0.8, 1.1.5 and 2.0.1. Developers are advised to update their .NET Core SDK to version 2.0.3 or 1.1.5.
See the release notes for a list of all the quality fixes in this release.
The .NET Core November 2017 Update is available from the .NET Core download page.
You can always download the version of .NET Core at .NET Downloads.
.NET Docker images have been updated for today’s release. The following repos have been updated.
The following repos are in the process of being updated:
Note: Look at the “Tags” view in each repository to see the updated Docker image tags.
Note: You must re-pull base images in order to get updates. The Docker client does not pull updates automatically.
Note: The Windows Docker tag scheme has changed.
The last few .NET Core updates follow: