.NET Core 2.1.30 Update - August 19, 2021

The .NET 2.1.30, .NET SDK 2.1.818 and .NET SDK 2.1.526 releases are available for download. The latest 2.1 release is always listed at .NET 2.1 Releases.

Downloads

1. Includes the .NET Core and ASP.NET Core Runtimes.
2. For hosting stand-alone apps on Windows Servers. Includes the ASP.NET Core Module for IIS and can be installed separately on servers without installing .NET Core runtime.

The .NET SDK includes a matching updated .NET Runtime. Downloading the Runtime or ASP.NET Core packages is not needed when installing the SDK.

You can check your .NET SDK version by running the following command. The example version shown is for this release.

$ dotnet --version
2.1.818

Visit .NET Documentation to learn about .NET, for building many different types of applications.

Docker Images

The .NET Core Docker images have been updated for this release. The .NET Docker samples show various ways to use .NET and Docker together.

The following repos have been updated:

• dotnet/sdk: .NET Core SDK
• dotnet/aspnet: ASP.NET Core Runtime
• dotnet/runtime: .NET Core Runtime
• dotnet/runtime-deps: .NET Core Runtime Dependencies

Visual Studio Compatibility

This update for .NET Core 2.1 includes multiple SDK builds. If you are a Visual Studio 2019, Visual Studio 2017 or Visual Studio for Mac user, there are MSBuild version requirements that are satisfied by specific, matching .NET Core SDK versions. See the following table to select the correct download.

.NET Core 2.1 will reach end of support on August 21, 2021. After this date, Microsoft will no longer provide technical support and updates (which includes security fixes) for this version. You'll need to update the version of .NET Core you're using to supported version (.NET Core 3.1 or .NET 5.0) before this date in order to continue to recieve updates.

Notable Changes

.NET Core 2.1.30 release carries both security and non-security fixes.

Microsoft Security Advisory CVE-2021-34485 | .NET Core Information Disclosure Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS.

Microsoft Security Advisory CVE-2021-26423 | .NET Core Denial of Service Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame.

Microsoft Security Advisory CVE-2021-34532 | ASP.NET Core Information Disclosure Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where an JWT token is logged if it cannot be parsed.

• Blog Roundup
• Known issues

Behavioral change in Asp.Net 2.1 Installers

Summary

Asp.Net Core 2.1.30 will now install side-by-side with Asp.Net 2.1.6 or earlier. It will still remove previously installed versions of Asp.Net that are 2.1.7 or newer. Users runnning the 2.1.30 Asp.Net Installer or 2.1.30 Hosting Bundle should manually uninstall any local versions of the Asp.Net runtime that are 2.1.6 or earlier.

Feedback

Your feedback is important and appreciated. We've created an issue at dotnet/core #6553 for your questions and comments.

Packages updated in this release: