(RHSA-2019:1236) Moderate: .NET Core on Red Hat Enterprise Linux security and bug fix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET Core that address security vulnerabilities are now available. The updated versions are .NET Core 1.0.16, 1.1.13, 2.1.11, and 2.2.5.

Security Fix(es):

• dotNET: timeouts for regular expressions are not enforced (CVE-2019-0820)

• dotNET: infinite loop in URI.TryCreate leading to ASP.Net Core Denial of Service (CVE-2019-0980)

• dotNET: crash in IPAddress.TryCreate leading to ASP.Net Core Denial of Service (CVE-2019-0981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Re-enable bash completion in rh-dotnet22-dotnet (BZ#1654863)

• Error rebuilding rh-dotnet22-curl in CentOS (BZ#1678932)

• Broken apphost caused by unset DOTNET_ROOT (BZ#1703479)

• Make bash completion compatible with rh-dotnet22 packages (BZ#1705259)