.NET Core 2.2.6 is available for download and usage in your environment. This release includes .NET Core 2.2.6, ASP.NET Core 2.2.6 and updates to the .NET Core SDK.
The July Update for .NET Core 2.1 includes multiple SDK builds. If you are a Visual Studio 2019, Visual Studio 2017 or Visual Studio for Mac user, there are MSBuild version requirements that are satisfied by specific, matching .NET Core SDK versions. See the table below to select the correct download. Otherwise, the best version to download is 2.2.401.
| OS | Development Environment | .NET Core SDK |
|---|---|---|
| Any supported | Command line and/or Visual Studio Code | 2.2.401 |
| Windows | Visual Studio 2019 version 16.2 | 2.2.401 |
| Windows | Visual Studio 2019 version 16.1 | 2.2.301 |
| Windows | Visual Studio 2019 version 16.0 | 2.2.205 |
| Windows | Visual Studio 2017 | 2.2.108 |
| MacOS | Visual Studio for Mac | Visual Studio for Mac .NET Core Support |
We’ve created an issue at dotnet/core #3007 for your questions and comments.
| SDK Installer1 | SDK Binaries1 | Runtime Installer | Runtime Binaries | ASP.NET Core Runtime | |
|---|---|---|---|---|---|
| Windows | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 | x86 | x64 Hosting Bundle2 |
| macOS | x64 | x64 | x64 | x64 | x641 |
| Linux | See installations steps below | x64 | ARM | ARM64 | x64 Alpine | - | x64 | ARM | ARM64 | x64 Alpine] | x641 | ARM321 | x64 Alpine1 |
| RHEL6 | - | x64 | - | x64 | - |
| Checksums | SDK | - | Runtime | - | - |
| Symbols | CLI | SDK | - | Runtime | Shared Framework | Setup | - | ASP.NET Core |
The .NET Core Docker images have been updated for this release. Details on our Docker versioning and how to work with the images can be seen in “Staying up-to-date with .NET Container Images”.
The following repos have been updated
The images are expected to be available later today.
.NET Core 1.0 and 1.1 reached end of support lifecycle on June 27, 2019 and will no longer receive updates going forward. See .NET Core Support Policy to learn more about the .NET Core support lifecycle.
Debian 10 GA finally released and we expect .NET Core availability on it later this month.
See .NET Core Supported OS Lifecycle Policy to learn about Windows, macOS and Linux versions that are supported for each .NET Core release.
.NET Core 2.2.6 release carries both security and non-security fixes.
Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and 2.2. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Microsoft is aware of a spoofing vulnerability that exists in ASP.NET Core that could lead to an open redirect. An attacker who successfully exploited the vulnerability could redirect a targeted user to a malicious website.
To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.
The update addresses the vulnerability by correcting how ASP.NET Core parses URLs.
Affected Package and Binary updates
| Package name | Vulnerable versions | Secure versions |
|---|---|---|
| Microsoft.AspNetCore.Server.HttpSys | 2.1.0, 2.1.1 2.2.0 |
2.1.12 2.2.6 |
| Microsoft.AspNetCore.Server.IIS | 2.2.0, 2.2.1, 2.2.2 | 2.2.6 |
| Microsoft.AspNetCore.All | 2.1.0 - 2.1.11 2.2.0 - 2.2.5 |
2.1.12 2.2.6 |
| Microsoft.AspNetCore.App | 2.1.0 - 2.1.11 2.2.0 - 2.2.5 |
2.1.12 2.2.6 |
| Package name | Version |
|---|---|
| dotnet-ef | 2.2.6 |
| Microsoft.AspNetCore.All | 2.2.6 |
| Microsoft.AspNetCore.App | 2.2.6 |
| Microsoft.AspNetCore.Mvc.Api.Analyzers | 2.2.6 |
| Microsoft.AspNetCore.Server.HttpSys | 2.2.6 |
| Microsoft.AspNetCore.Server.IIS | 2.2.6 |
| Microsoft.Data.Sqlite | 2.2.6 |
| Microsoft.Data.Sqlite.Core | 2.2.6 |
| Microsoft.DotNet.Web.Client.ItemTemplates | 2.2.6 |
| Microsoft.DotNet.Web.ItemTemplates | 2.2.6 |
| Microsoft.DotNet.Web.ProjectTemplates.2.2 | 2.2.6 |
| Microsoft.DotNet.Web.Spa.ProjectTemplates | 2.2.6 |
| Microsoft.EntityFrameworkCore | 2.2.6 |
| Microsoft.EntityFrameworkCore.Abstractions | 2.2.6 |
| Microsoft.EntityFrameworkCore.Analyzers | 2.2.6 |
| Microsoft.EntityFrameworkCore.Design | 2.2.6 |
| Microsoft.EntityFrameworkCore.InMemory | 2.2.6 |
| Microsoft.EntityFrameworkCore.Proxies | 2.2.6 |
| Microsoft.EntityFrameworkCore.Relational | 2.2.6 |
| Microsoft.EntityFrameworkCore.Relational.Specification.Tests | 2.2.6 |
| Microsoft.EntityFrameworkCore.Specification.Tests | 2.2.6 |
| Microsoft.EntityFrameworkCore.Sqlite | 2.2.6 |
| Microsoft.EntityFrameworkCore.Sqlite.Core | 2.2.6 |
| Microsoft.EntityFrameworkCore.Sqlite.NetTopologySuite | 2.2.6 |
| Microsoft.EntityFrameworkCore.SqlServer | 2.2.6 |
| Microsoft.EntityFrameworkCore.SqlServer.NetTopologySuite | 2.2.6 |
| Microsoft.EntityFrameworkCore.Tools | 2.2.6 |
| Microsoft.NETCore.Platforms | 2.2.2 |
| Microsoft.NETCore.App | 2.2.6 |
| Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| Microsoft.NETCore.DotNetHost | 2.2.6 |
| Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.linux-arm.Microsoft.NETCore.App | 2.2.6 |
| runtime.linux-arm.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.linux-arm.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.linux-arm.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.linux-arm.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.linux-arm64.Microsoft.NETCore.App | 2.2.6 |
| runtime.linux-arm64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.linux-arm64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.linux-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.linux-arm64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.linux-musl-x64.Microsoft.NETCore.App | 2.2.6 |
| runtime.linux-musl-x64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.linux-musl-x64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.linux-musl-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.linux-x64.Microsoft.NETCore.App | 2.2.6 |
| runtime.linux-x64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.linux-x64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.linux-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.linux-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.osx-x64.Microsoft.NETCore.App | 2.2.6 |
| runtime.osx-x64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.osx-x64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.osx-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.osx-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.rhel.6-x64.Microsoft.NETCore.App | 2.2.6 |
| runtime.rhel.6-x64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.rhel.6-x64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.rhel.6-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.win-arm.Microsoft.NETCore.App | 2.2.6 |
| runtime.win-arm.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.win-arm.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.win-arm.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.win-arm.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.win-arm64.Microsoft.NETCore.App | 2.2.6 |
| runtime.win-arm64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.win-arm64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.win-arm64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.win-arm64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.win-x64.Microsoft.NETCore.App | 2.2.6 |
| runtime.win-x64.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.win-x64.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.win-x64.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.win-x64.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |
| runtime.win-x86.Microsoft.NETCore.App | 2.2.6 |
| runtime.win-x86.Microsoft.NETCore.DotNetAppHost | 2.2.6 |
| runtime.win-x86.Microsoft.NETCore.DotNetHost | 2.2.6 |
| runtime.win-x86.Microsoft.NETCore.DotNetHostPolicy | 2.2.6 |
| runtime.win-x86.Microsoft.NETCore.DotNetHostResolver | 2.2.6 |