Today, we are releasing the .NET March 2024 Updates. These updates contain security and non-security improvements. Your app may be vulnerable if you have not deployed a recent .NET update.
You can download 8.0.3, 7.0.17 and, 6.0.28 versions for Windows, macOS, and Linux, for x86, x64, Arm32, and Arm64.
Installers and binaries: 8.0.3 |7.0.17 | 6.0.28
Release notes: 8.0.31 | 7.0.17 | 6.0.28
Container images
Linux packages: 8.0.3 | 7.0.17 | 6.0.28
Release feedback/issue
Known issues: 8.0 | 7.0 | 6.0
Windows Package Manager CLI (winget)
You can now install .NET updates using the Windows Package Manager CLI (winget):
To install the .NET 8 runtime: winget install dotnet-runtime-8
To install the .NET 8 SDK: winget install dotnet-sdk-8
To update an existing installation: winget upgrade
See Install with Windows Package Manager (winget) for more information.
Improvements
ASP.NET Core: 8.0.3
Entity Framework Core: 8.0.3
Runtime: 8.0.3 | 7.0.17 | 6.0.28
SDK: 8.0.3
Security
CVE-2024-21392 | .NET Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0 . This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.
A vulnerability exists in .NET where specially crafted requests may cause a resource leak, leading to a Denial of Service
CVE-2024-26190 | Microsoft QUIC Denial of Service Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A Vulnerability exist in MsQuic.dll which might result in a peer to allocate small chunks of memory as long as connection stays alive.
Visual Studio
See release notes for Visual Studio compatibility for .NET 8.0, .NET 7.0 and, .NET 6.0.
The post .NET March 2024 Updates – .NET 8.0.3, 7.0.17, .NET 6.0.28 appeared first on .NET Blog.