Releases.json for .NET 8.0 Missing Required Package Versions

[ushak8089]

URL(s)

Hello,

I noticed that the releases.json file for .NET 8.0 hosted at https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json does not include the required package versions (8.0.108-8.0.8-0ubuntu1~24.04.1) for the following packages:

dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0

Description

Hello,

I noticed that the releases.json file for .NET 8.0 hosted at https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json does not include the required package versions (8.0.108-8.0.8-0ubuntu1~24.04.1) for the following packages:

dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0

This discrepancy is causing issues with automated workflows and dependency checks that rely on this file for versioning information.

Could you please confirm if there’s an issue with the metadata update process or provide clarification on why the required versions are missing?

[ushak8089]

@richlander

[mairaw]

@rbhanda can you check this?

[rbhanda]

Hello,
Can I get more information on which packages are missing? Are the available in https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/9.0/releases.json?

[ushak8089]

@rbhanda

I am using .NET 8.0 for my Ubuntu 24 VM, and I’ve been referencing the release-metadata for version updates.

I am attempting to fix some vulnerabilities, and the report suggests upgrading the following packages from version 8.0.12-0ubuntu124.04.1 to 8.0.108-8.0.8-0ubuntu124.04.1:

dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0
However, I’ve been unable to find the required 8.0.108 version for these packages, as the official download page for .NET 8.0 (https://dotnet.microsoft.com/en-us/download/dotnet/8.0) does not list it.

I would appreciate any guidance or updated download links for these packages so I can proceed with addressing the vulnerabilities.

Note:- Vulnerability report suggesting (Refer to Ubuntu security advisory USN-6959-1 (https://ubuntu.com/security/notices/USN-6959-1) for updates and patch information.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
USN-6959-1: Ubuntu Linux (https://ubuntu.com/security/notices/USN-6959-1))

CVE-2024-38167

[ushak8089]

@rbhanda

I am using .NET 8.0 for my Ubuntu 24 VM, and I’ve been referencing the release-metadata for version updates.

I am attempting to fix some vulnerabilities, and the report suggests upgrading the following packages from version 8.0.12-0ubuntu124.04.1 to 8.0.108-8.0.8-0ubuntu124.04.1:

dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0
However, I’ve been unable to find the required 8.0.108 version for these packages, as the official download page for .NET 8.0 (https://dotnet.microsoft.com/en-us/download/dotnet/8.0) does not list it.

I would appreciate any guidance or updated download links for these packages so I can proceed with addressing the vulnerabilities.

Note:- Vulnerability report suggesting (Refer to Ubuntu security advisory USN-6959-1 (https://ubuntu.com/security/notices/USN-6959-1) for updates and patch information.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
USN-6959-1: Ubuntu Linux (https://ubuntu.com/security/notices/USN-6959-1))

[rbhanda]

@leecow do you know about these files

`I am attempting to fix some vulnerabilities, and the report suggests upgrading the following packages from version 8.0.12-0ubuntu124.04.1 to 8.0.108-8.0.8-0ubuntu124.04.1:

dotnet-host-8.0
aspnetcore-runtime-8.0
dotnet-apphost-pack-8.0
aspnetcore-targeting-pack-8.0
dotnet-runtime-8.0
dotnet-hostfxr-8.0
dotnet-targeting-pack-8.0 `

[leecow]

@ushak8089 - for 24.04, it's recommended to use the .NET packages provided by Canonical, rather than the Microsoft provided packages (details here). An easy way to confirm you are using the Canonical packages is to run dotnet --info and check the install directory. When installing the Canonical packages, the directory will be /usr/lib/dotnet. For example:

.NET SDKs installed:
  8.0.112 [/usr/lib/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 8.0.12 [/usr/lib/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 8.0.12 [/usr/lib/dotnet/shared/Microsoft.NETCore.App]

.NET 8.0.12 is available now from Canonical so simply running apt install dotnet-sdk-8.0 will update your VM.

[ushak8089]

@leecow Than you for quick response!
We are currently automated .NET installations for Ubuntu 22.04 and Ubuntu 24.04 VMs. During this process, our scripts download .NET SDK and runtime packages directly from:
https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json

However, this approach raises potential security vulnerabilities for ubuntu 24.04 as we are directly fetching packages from Microsoft’s blob storage.

Could you provide a direct, secure link to Canonical-provided .NET packages that we can use instead, ensuring compliance with Ubuntu's repositories? This will help us align with Canonical's package management and address any vulnerability concerns in our automated workflows.

Thank you for your assistance!

[leecow]

.NET 8 updates for Noble are available on Canonical's "noble-updates" feed under devel. See the following:

• https://packages.ubuntu.com/en/noble-updates/devel/
• https://launchpad.net/ubuntu/noble/+package/dotnet8

[ushak8089]

@leecow

Thank you for sharing the links to Canonical's "noble-updates" feed and Launchpad for .NET 8 packages. However, I noticed that the required 8.0.108 version is not available in the repository. This version is crucial for resolving the reported vulnerabilities in our environment.

Your assistance in resolving this issue would be greatly appreciated.

[leecow]

Based on my check before my first reply this evening, the repo has 8.0.112 available. This is supported by the information availble at https://launchpad.net/ubuntu/noble/+package/dotnet8.

[leecow]

I just noticed you also mention 22.04. Confirmed that 8.0.12 is also available in the Jammy update feed.

root@ac6ab1aa0b3e:/# cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

root@ac6ab1aa0b3e:/# apt search dotnet-sdk-8.0
Sorting... Done
Full Text Search... Done
dotnet-sdk-8.0/jammy-updates,jammy-security 8.0.112-0ubuntu1~22.04.1 amd64
  .NET 8.0 Software Development Kit

dotnet-sdk-8.0-source-built-artifacts/jammy-updates,jammy-security 8.0.112-0ubuntu1~22.04.1 amd64
  Internal package for building the .NET 8.0 Software Development Kit

[ushak8089]

@leecow

We’re encountering an issue with .NET packages on Ubuntu 24. While the correct versions version here:

azure-arm.build_vhd: Get:2 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-host-8.0 amd64 8.0.12-0ubuntu124.04.1 [187 kB]
azure-arm.build_vhd: Get:3 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-hostfxr-8.0 amd64 8.0.12-0ubuntu124.04.1 [144 kB]
azure-arm.build_vhd: Get:4 http://azure.archive.ubuntu.com/ubuntu noble/main amd64 liblttng-ust-common1t64 amd64 2.13.7-1.1ubuntu2 [27.5 kB]
azure-arm.build_vhd: Get:5 http://azure.archive.ubuntu.com/ubuntu noble/main amd64 liblttng-ust-ctl5t64 amd64 2.13.7-1.1ubuntu2 [74.9 kB]
azure-arm.build_vhd: Get:6 http://azure.archive.ubuntu.com/ubuntu noble/main amd64 liblttng-ust1t64 amd64 2.13.7-1.1ubuntu2 [185 kB]
azure-arm.build_vhd: Get:7 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-runtime-8.0 amd64 8.0.12-0ubuntu124.04.1 [23.9 MB]
azure-arm.build_vhd: Get:8 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 aspnetcore-runtime-8.0 amd64 8.0.12-0ubuntu124.04.1 [8366 kB]
azure-arm.build_vhd: Get:9 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 aspnetcore-targeting-pack-8.0 amd64 8.0.12-0ubuntu124.04.1 [1919 kB]
azure-arm.build_vhd: Get:10 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-apphost-pack-8.0 amd64 8.0.12-0ubuntu124.04.1 [3886 kB]
azure-arm.build_vhd: Get:11 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-targeting-pack-8.0 amd64 8.0.12-0ubuntu124.04.1 [2953 kB]
azure-arm.build_vhd: Get:12 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-templates-8.0 amd64 8.0.112-0ubuntu124.04.1 [2196 kB]
azure-arm.build_vhd: Get:13 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 netstandard-targeting-pack-2.1-8.0 amd64 8.0.112-0ubuntu124.04.1 [1392 kB]
azure-arm.build_vhd: Get:14 http://azure.archive.ubuntu.com/ubuntu noble-updates/main amd64 dotnet-sdk-8.0 amd64 8.0.112-0ubuntu124.04.1 [90.8 MB]

It is looking for downgrade it seems (Refer to Ubuntu security advisory USN-6959-1 (https://ubuntu.com/security/notices/USN-6959-1) for updates and patch information.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
USN-6959-1: Ubuntu Linux (https://ubuntu.com/security/notices/USN-6959-1))

Package Installed Version Required Version
dotnet-host-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1
aspnetcore-runtime-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1
dotnet-apphost-pack-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1
aspnetcore-targeting-pack-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1
dotnet-runtime-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1
dotnet-hostfxr-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1
dotnet-targeting-pack-8.0 8.0.12-0ubuntu124.04.1 8.0.108-8.0.8-0ubuntu124.04.1#

Note:- this issue is not present on Ubuntu 22, where the installation works without triggering vulnerabilities.

Could you help us understand:

Why the advisory suggests downgrading to older versions, even though newer versions are installed?
Whether there’s a fix or patch specifically for Ubuntu 24 to address the vulnerabilities while keeping the latest versions?
Is there any issue happening with ubuntu 24?