Security Advisory Notice for 16.6.2

CVE-2020-1108 / CVE-2020-1108.NET Core Denial of Service Vulnerability

To comprehensively address CVE-2020-1108, Microsoft has released updates for .NET Core 2.1 and .NET Core 3.1. Customers who use any of these versions of .NET Core should install the latest version of .NET Core. See the Release Notes for the latest version numbers and instructions for updating .NET Core.

CVE-2020-1202 / CVE-2020-1203 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fails to properly handle objects in memory.

CVE-2020-1293 / CVE-2020-1278 / CVE-2020-1257 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations

Top Issues Fixed in Visual Studio 2019 version 16.6.2

• Visual Studio 2019 16.60 hang at run or build when modified not saved in C++/CLI project
• An unhandled exception of type 'System.NullReferenceException' occurred in Microsoft.VisualStudio.DesignTools.WpfTap.dll
• Recurring null reference when reopening documents
• "Create new project" dialog search does not find templates for third-party language providers
• IntelliSense shows that "tilde-slash" (~/) points to ASP .NET Core 3.1 project root instread of wwwroot subfolder after upgrading Visual Studio Enterprise 16.5.6->16.6.0
• Fixed a compiler error (error C2475: redefinition; 'constexpr' specifier mismatch) affecting std::atomic when compiled as C++/CX in C++17 mode.
• URL completion values and format was fixed in Razor views. App-relative URL format is now used again and the values in the URL completion list show files and folders rooted under app root, i.e. wwwroot.
• Fixed a crash when using snippets.
• Restore item templates that could be hidden by extensions.

The Window component for Angular was added with the R1 2018 release!

One year ago MVVM wasn’t very famous. I remember the first article I read about it, about using MVVM to simplify the management of treeview controls. In the last six months, MVVM has been quickly promoted to THE methodology to use when developing WPF applications. During this amount of time, famous WPF developers started to merge their existing MVVM classes into libraries. Those libraries are now known as MVVM frameworks and contain classes designed to help developers to use MVVM in their projects 

Safari, Firefox, Edge and Chrome are removing support for TLS 1.0 and 1.1 in March of 2020. If you manage websites, this means there’s less than a year to enable TLS 1.2 (and, ideally, 1.3) on your servers, otherwise all major browsers will display error pages, rather than the content your users were expecting to find. 

Bridge Network Driver

The bridge networking driver is the first driver on our list. It’s simple to understand, simple to use, and simple to troubleshoot, which makes it a good networking choice for developers and those new to Docker. The bridge driver creates a private network internal to the host so containers on this network can communicate. External access is granted by exposing ports to containers. Docker secures the network by managing rules that block connectivity between different Docker networks. 

Overlay Network Driver

The built-in Docker overlay network driver radically simplifies many of the complexities in multi-host networking. It is a swarm scope driver, which means that it operates across an entire Swarm or UCP cluster rather than individual hosts. With the overlay driver, multi-host networks are first-class citizens inside Docker without external provisioning or components. IPAM, service discovery, multi-host connectivity, encryption, and load balancing are built right in. For control, the overlay driver uses the encrypted Swarm control plane to manage large scale clusters at low convergence times. 

MACVLAN Driver

The macvlan driver is the newest built-in network driver and offers several unique characteristics. It’s a very lightweight driver, because rather than using any Linux bridging or port mapping, it connects container interfaces directly to host interfaces. Containers are addressed with routable IP addresses that are on the subnet of the external network.

As a result of routable IP addresses, containers communicate directly with resources that exist outside a Swarm cluster without the use of NAT and port mapping. This can aid in network visibility and troubleshooting. Additionally, the direct traffic path between containers and the host interface helps reduce latency. macvlan is a local scope network driver which is configured per-host. As a result, there are stricter dependencies between MACVLAN and external networks, which is both a constraint and an advantage that is different from overlay or bridge. 

Add It Up: Takeaways from GitHub’s Octoverse Report – The New Stack 

All the features are described in wonderful detail in the docs. Start with the overview, What’s new in C# 7.2, which gives you an excellent introduction to the new set of capabilities. 

• Team Explorer - Changes: panel not sizing to the Team Explorer window.
• Visual Studio 2017 SQL Server Object Explorer server list not persisting .
• intellisense problems with linux-x64 mode.
• Index was out of range. Must be non-negative and less than the size of the collection.Parameter name: index.
• Visual Studio 2017 UNDO does not work/stops working (reported AGAIN!!!!).
• Intellisense not working for files created under WSL.
• Intellisense error: C++11 static constexpr member initialization causes "member may not be initialized".
• VS doesn't restore windows position when switching in/out of debug.
• Third party toolbox items are reloaded every time VS2019 Preview 2.2 is started.
• 'Set as StartUp Project' crashes the IDE after updating to VS2019 Preview Release 3.
• Visual Studio 2019 building Visual Studio 2017 C++ projects fail.
• Fixed Toolbox refresh issue.
• Toolbox controls are making vssettings file too big.
• SSDT: Fix for Login failed errors when performing a New Data comparison function .
• SSDT: Fix for Source is Unavailable error when performing Schema Compare .
• SSDT: Fix for Schema Compare Generate Script does not generate script .
• SSDT: Fix to improve performance of loading solutions with multiple projects.
• SSDT: Fix for SQL files not always being deleted when performing a Schema Compare between a database and a project and a delete table is executed subsequently.
• SSDT: Accessibility fixes to improve narration capabilities.
• SSDT: Replaced older sqlncli driver with new Microsoft ODBC Driver for SQL Server. 

This article is in the Product Showcase section for our sponsors at CodeProject. These reviews are intended to provide you with information on products and services that we consider useful and of value to developers. 

The React ecosystem is so large that it's helpful to be presented with some sound, standard options when selecting libraries for a new project. This is the latest annual update of an established list Robin maintains.