Clarification on .NET patches installed on the image

[angaaruriakhil]

Hi,

Thanks for the work on these images. We use the code in this repository monthly to build images for use with VMSS. I'd like to get some clarity on the .NET patches installed on the Windows images.

From the readme, it says, for .NET Core: “2 latest LTS versions and 1 latest version. For each feature version only latest patch is installed”.

Our Qualys scans are flagging up that the following patches are missing:

• Microsoft .NET Core Security Update for January 2024
• Microsoft .NET Security Update for September 2022
• Microsoft .NET Core and ASP.NET Core Security Update for November 2023
• Microsoft .NET Core and ASP.NET Core Security Update for February 2024
• Microsoft .NET Security Update for July 2023
• Microsoft .NET Security Update for June 2023
• Microsoft .NET Security Update for April 2023
• Microsoft .NET Security Update for February 2023
• Microsoft .NET Security Update for December 2022
• Microsoft .NET (NuGet Client) Security Update for October 2022
• Microsoft .NET Framework Update for April 2024
• Microsoft .NET Security Update for April 2024
• Microsoft .NET Security Update for March 2024
• Microsoft .NET Security Update for October 2023
• Microsoft .NET Security Update for September 2023
• Microsoft .NET Security Update for August 2023
• Microsoft .NET Security Update for January 2023
• Microsoft .NET Security Update for August 2022
• Microsoft .NET Security Update for June 2022

It sounds like the latest patches should be getting installed which should cover these, particularly this should be covered in the Install-WindowsUpdate.ps1 script.

Could I kindly request some clarification on if these patches are missing in the image, and how we might appropriately remediate these in our images? Thanks.

[kishorekumar-anchala]

Hi @angaaruriakhil ,

Could you please try with latest release version 20240721.1 .

[angaaruriakhil]

Thank you for addressing this.

We need to do a rebuild, we don't use the MS-hosted agents but build our own VMSS with this repo. But we are facing issue #10331 which prevents us from completing our build.

We are also currently internally transitioning our vulnerability process. We can't run a scan at the moment unfortunately but should be able to again in the coming weeks.

Could you kindly summarise the changes that have been made? I can't see anything relevant in the commits for main, but I may be missing something.

Thanks!