Fetch updated "4.8-windowsservercore-ltsc2019" image with fixes of CVE-2021-24111

[vikasbhaimehta]

We recently found an high vulnerability [CVE-2021-24111] in image "4.8-20210209-windowsservercore-ltsc2019". As per the scan the fixes is available in KB4601887. So how can we get the updated image with this fixes?

Appreciate guidance in advance.

[mthalman]

There are two separate cumulative updates that both fix CVE-2021-24111 on Windows Server 2019: KB4601887 (for 3.5, 4.7.2, and 4.8) and KBKB4601055 (for 3.5 and 4.8). As you can see, in both those links it states that it addresses CVE-2021-24111. The 4.8-windowsservercore-ltsc2019 tag contains the latter KB number as you can see in the Dockerfile:

dotnet-framework-docker/src/runtime/4.8/windowsservercore-ltsc2019/Dockerfile

Line 19 in e3615cc

&& dism /Online /Quiet /Add-Package /PackagePath:C:\patch\windows10.0-kb4601055-x64-ndp48.cab `

So my guess is that this circumstance of having two cumulative updates that both fix the CVE is just confusing the scanner and leading to a false positive. What scanning service are you using?