11–20 of 57 posts
This is why I advocate for .NET in serious business contexts. You often don't have to rebuild or redeploy your software if you are using the included batteries as intended. A devops intern could handle this fix. Contrast with virtually any other ecosystem.
> If you are running .NET 8 or later install the .NET update from Microsoft Update, then restart your application or reboot the machine. This is why I advocate for .NET in serious business contexts. You often don't have to rebuild or redeploy your software if you are using the included batteries as intended. A devops intern could handle this fix. Contrast with virtually any other ecosystem.
Note that this affects ".net core", not ".net framework" https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
I don't think this is correct:
.NET 4.8 / 4.8.1 shows does not have an end of support date set: https://dotnet.microsoft.com/en-us/platform/support/policy/d...
Also ASP.NET MVC 5 does not have an end of support date set: https://dotnet.microsoft.com/en-us/platform/support/policy/a...
There are plenty of apps out there were there is no feasible upgrade path to .NET Core / .NET 9, so I imagine MS will continue to support these for a very long time. Note that the VB6 runtime is still supported in all Windows operating systems: https://learn.microsoft.com/en-us/previous-versions/visualst...
For context around the score https://github.com/dotnet/aspnetcore/issues/64033#issuecomme...
The bug itself doesn't enable any of those. An app using the library might have that vuln.
Earlier quoted context omitted.
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
The last sentence is not correct. ASP.NET is part of .NET Framework which is still supported by nature of being included with Windows, and follows its support lifecycle. https://dotnet.microsoft.com/en-us/platform/support/policy/a... This is, IMO, a bad thing, and Microsoft needs to break this chain at some point, at least for ASP.NET. But, it is still technically supported.
Sorry, I did not know they had actually brought non-Core ASP.NET forward into 5.0+, but it makes sense given how much of .NET Framework they continued support for and how much ASP.NET and Forms stuff is still around in enterprise with no budget for bringing it forward.
Totally agree with breaking the chain though, we moved to Core around 2.0 and never looked back, as an ecosystem it is so much better.
I guess this is the kind of CVE that will make CISOs in BigCorps scream "fix it now!!" to everyone down the chain, right?
For context around the score https://github.com/dotnet/aspnetcore/issues/64033#issuecomme...
For context around the score https://github.com/dotnet/aspnetcore/issues/64033#issuecomme...
This is a dumb way of scoring the bug. The bug itself doesn't enable any of those. An app using the library might have that vuln.
It might be right, but it also feels so wrong.
I would in reality probably rank this issue lower. And in some more properly engineered systems it would have lot less criticality.
> If you are running .NET 8 or later install the .NET update from Microsoft Update, then restart your application or reboot the machine. This is why I advocate for .NET in serious business contexts. You often don't have to rebuild or redeploy your software if you are using the included batteries as intended. A devops intern could handle this fix. Contrast with virtually any other ecosystem.
Earlier quoted context omitted.
There is no .NET Core or .NET Framework since .NET 5.0 in 2020. Maybe you mean ASP.NET Core, but then there is no ASP.NET Framework so the comment still does not make sense to me. The vulnerable component is ASP.NET Core, which did not change name when .NET dropped the Core name to distinguish it from legacy ASP.NET. --- edit: cut here - the sentence below is incorrect! --- If somehow you were still using legacy ASP.…
> If somehow you were still using legacy ASP.NET / Framework 4.8 etc, you have much bigger problems - legacy ASP.NET has been unsupported since 2022 so will definitely not be receiving security updates. I don't think this is correct: .NET 4.8 / 4.8.1 shows does not have an end of support date set: https://dotnet.microsoft.com/en-us/platform/support/policy/d... Also ASP.NET MVC 5 does not have an end of support date s…
We had code using WCF and AppDomains that were always out of scope for .NET Core. WCF has a Core replacement now that is not quite one-for-one but AppDomains will never be supported in .NET Core / .NET 5.0+ and would indeed have to stay on 4.8 / 4.8.1 if they were still running.