Security Advisory Notice for 16.6.2

CVE-2020-1108 / CVE-2020-1108.NET Core Denial of Service Vulnerability

To comprehensively address CVE-2020-1108, Microsoft has released updates for .NET Core 2.1 and .NET Core 3.1. Customers who use any of these versions of .NET Core should install the latest version of .NET Core. See the Release Notes for the latest version numbers and instructions for updating .NET Core.

CVE-2020-1202 / CVE-2020-1203 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fails to properly handle objects in memory.

CVE-2020-1293 / CVE-2020-1278 / CVE-2020-1257 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations

Top Issues Fixed in Visual Studio 2019 version 16.6.2

• Visual Studio 2019 16.60 hang at run or build when modified not saved in C++/CLI project
• An unhandled exception of type 'System.NullReferenceException' occurred in Microsoft.VisualStudio.DesignTools.WpfTap.dll
• Recurring null reference when reopening documents
• "Create new project" dialog search does not find templates for third-party language providers
• IntelliSense shows that "tilde-slash" (~/) points to ASP .NET Core 3.1 project root instread of wwwroot subfolder after upgrading Visual Studio Enterprise 16.5.6->16.6.0
• Fixed a compiler error (error C2475: redefinition; 'constexpr' specifier mismatch) affecting std::atomic when compiled as C++/CX in C++17 mode.
• URL completion values and format was fixed in Razor views. App-relative URL format is now used again and the values in the URL completion list show files and folders rooted under app root, i.e. wwwroot.
• Fixed a crash when using snippets.
• Restore item templates that could be hidden by extensions.

C# 7 is a major update with a lot of interesting new capabilities. And while there are plenty of articles on what you can do with it, there aren't quite as many on what you should do with it. Using the principles found in the .NET Framework Design Guidelines, we're going to take a first pass at laying down strategies for getting the most from these new features. 

croc is a tool that allows any two computers to simply and securely transfer files and folders. AFAIK, croc is the only CLI file-transfer tool that does all of the following:

• allows any two computers to transfer data (using a relay)
• provides end-to-end encryption (using PAKE)
• enables easy cross-platform transfers (Windows, Linux, Mac)
• allows multiple file transfers
• allows resuming transfers that are interrupted
• local server or port-forwarding not needed
• ipv6-first with ipv4 fallback 

EF Core 8, or just EF8, is the successor to EF Core 7. EF8 requires .NET 8. It will not work with .NET 6 or 7, or with any version of .NET Framework. 

The following high-level features are planned for the ASP.NET Core 2.1 release:

SignalR - Real-time web framework on ASP.NET Core (aspnet/SignalR#394)
HTTPS - On by default and easy to configure (aspnet/Home#2308)
GDPR compliance - Templates updated with new privacy features (aspnet/Security#1561, aspnet/Identity#1341)
Web API conventions - Rich Swagger support without attributes (aspnet/Mvc#6870, aspnet/Mvc#6784)
IHttpClientFactory - HttpClient as a service, handle cross-cutting concerns like caching, retry logic, timeouts and circuit breakers (aspnet/HttpClientFactory#42)
ASP.NET Core Module in-proc hosting - 6x the throughput on IIS! Better startup error handling (aspnet/AspNetCoreModule#265)
Razor pages improvements - Support for areas, ~/Pages/Shared (aspnet/Mvc#6926, aspnet/Mvc#7193)
MVC functional test fixture - Easily test your MVC apps end-to-end (aspnet/Mvc#6233)
Build-time Razor - Compile Razor pages and views as part of your build, improved startup performance (aspnet/Razor#1809)
UI as a library - Package Razor pages and views as reusable libraries (aspnet/Razor#1809)
Identity UI package and scaffolder - Add identity to any application (aspnet/Home#2311)
WebHooks - Handle WebHook notifications from ASP.NET Core apps (aspnet/WebHooks#5)

Learn to leverage a variety of PowerShell commands to invoke scripts that work with existing frameworks, including .NET and XML, to optimize productivity. 

.NET 6 Preview 1 is now available and ready for evaluation. This is the first preview of .NET 6, the next major update to the .NET platform. .NET 6 is expected to ship in November of this year, and will be a Long Term Support (LTS) release. 

Microsoft has announced that the .NET Core 2.0 will be considered "end of life" and thus no longer supported as of October 1, 2018.  .NET Core 2.0 is considered a non-LTS release, and as such Microsoft only commits its support for three months after a successor has been released.  In this case, with .NET Core 2.1 having been released May 31, .NET Core 2.0’s end has come. 

    public class Person
    {
        public string FirstName { get; set; }
    }

    public class PersonWithCtor
    {
        public PersonWithCtor(string firstName)
        {
            this.FirstName = firstName;
        }

        public string FirstName { get; set; }
    }

Person person = new Person();

var person = new Person();

Person person = new();

Person person = new("User 1");

var personList = new List<Person>
        {
            new ("User 1"),
            new ("User 2"),
            // ...
        };

public void Adopt(Person p)
{
    //...
}

public void CallerMethod()
{
    this.Adopt(new Person("User 1"));
    // C# 9.0
    this.Adopt(new("User 1"));
}

XmlReader.Create(reader, new XmlReaderSettings() { IgnoreWhitespace = true });
// C# 9.0
XmlReader.Create(reader, new() { IgnoreWhitespace = true });

Person person = new
{
   FirstName = "User 2"
};

Person person = new()
{
   FirstName = "User 2"
};

private ConcurrentDictionary<string, ObservableList<Cat>> _catsBefore = new ConcurrentDictionary<string, ObservableList<Cat>>();

private ConcurrentDictionary<string, ObservableList<Cat>> _cats = new(); // C# 9.0

public ObservableCollection<Friend> Friends { get; } = new();

public interface IAnimal
{
}

public class Dog : IAnimal
{
}

public class Cat : IAnimal
{
}

Cat cat = null;
Dog dog = new();
IAnimal animal = cat ?? dog;

(int a, int b) t = new(1, 2); // "new" is redundant

(int a, int b) t = new(); // OK; same as (0, 0)