.NET Core July 2018 Update

Today, we are releasing the .NET Core July 2018 Update. This update includes .NET Core 1.0.12, .NET Core 1.1.9, .NET Core 2.0.9 and .NET Core 2.1.2.

Security

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a security feature bypass vulnerability that exists when .NET Core does not correctly validate certificates. An attacker who successfully exploited this vulnerability could present an expired certificate when challenged.

The update addresses the vulnerability by correcting how .NET Core applications handle certificate validation.

CVE-2018-8356: .NET Core Security Feature Bypass Vulnerability

Getting the Update

The latest .NET Core updates are available on the .NET Core download page.

Today’s releases are listed as follows:

• .NET Core 2.1.2
• .NET Core 2.0.9
• .NET Core 1.1.9
• .NET Core 1.0.12

Docker Images

.NET Docker images have been updated for today’s release. The following repos have been updated.

• microsoft/dotnet
• microsoft/dotnet-samples
• microsoft/aspnetcore
• microsoft/aspnetcore-build

Note: Look at the “Tags” view in each repository to see the updated Docker image tags.

Note: You must re-pull base images in order to get updates. The Docker client does not pull updates automatically.

Preview .NET Core Updates

The last few .NET Core updates follow:

• June 2018 Update
• May 2018 Update
• April 2018 Update