Today, we are releasing the .NET Core January 2019 Update. These updates contain security and reliability fixes. See the individual release notes for details on included reliability fixes.
- .NET Core 2.2.2 and .NET Core SDK 2.2.104 ( Download | Release Notes )
- .NET Core 2.1.8 and .NET Core SDK 2.1.504 ( Download | Release Notes )
- .NET Core 1.1.11 and .NET Core SDK 1.1.12 ( Download | Release Notes )
- .NET Core 1.0.14 and .NET Core SDK 1.1.12 ( Download | Release Notes )
Security
Microsoft Security Advisory CVE-2019-0657: .NET Core Domain Spoofing Vulnerability
A domain spoofing vulnerability exists in .NET Framework and .NET Core which causes the meaning of a URI to change when International Domain Name encoding is applied. An attacker who successfully exploited the vulnerability could redirect a URI. This issue effects .NET Core 1.0, 1.1 2.1 and 2.2.
The security update addresses the vulnerability by not allowing certain Unicode characters from the URI.
Getting the Update
The latest .NET Core updates are available on the .NET Core download page. This update is also included in the Visual Studio 15.0.21 (.NET Core 1.0 and 1.1) and 15.9.7 (.NET Core 1.0, 1.1 and 2.1) updates, which is also releasing today.
See the .NET Core release notes ( 1.0.14 | 1.1.11 | 2.1.8 | 2.2.2 ) for details on the release including a issues fixed and affected packages.
Docker Images
.NET Docker images have been updated for today’s release. The following repos have been updated.
microsoft/dotnet
microsoft/dotnet-samples
microsoft/aspnetcore
Note: Look at the “Tags” view in each repository to see the updated Docker image tags.
Note: You must re-pull base images in order to get updates. The Docker client does not pull updates automatically.
Azure App Services deployment
Deployment of these updates Azure App Services has begun. We’ll keep this section updated as the regions go live. Deployment to all regions is expected to complete in a few days.
Lifecycle Information
The following lifecycle documents describe Microsoft support policies and should be consulted to ensure that you are using supported .NET Core versions.