microsoft / microsoft/VFSForGit
Target latest revision of .NET Core 2.1.x to avoid security issues
Open
@mjcheetham is already working on this.
Since Jul 12, 2019.
affects: security
platform: linux
platform: macOS
- Dominant language
- C#
- Stars
- 6.1k
- Forks
- 474
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 8
Description
There are two CVEs open against the version of .NET Core we are targeting. We should bump to the latest revision of 2.1.x to mitigate.
| CVE | Vulnerable .NET Core versions | Secure versions |
|---|---|---|
| CVE-2018-8416 | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6 | 2.1.7 |
| CVE-2019-0657 | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.2.0, 2.2.1 | 2.1.8, 2.2.2 |
We should target 2.1.8.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.