Microsoft today announced that multiple .NET Framework versions signed using the legacy and insecure Secure Hash Algorithm 1 (SHA-1) will reach end of support next year.
The .NET Framework is a free software development framework that helps developers build .NET applications, websites, and services and users to run them on many operating systems (including Windows), using different implementations of .NET.
“.NET Framework 4.5.2, 4.6, and 4.6.1 will reach end of support on April 26, 2022,” said Jamshed Damkewala, .NET Principal Engineering Manager.
“After this date, we will no longer provide updates including security fixes or technical support for these versions.”
The only exception is the .NET Framework 4.6 version that ships with Windows 10 Enterprise LTSC 2015, which will get its support extended to October 2025, when the OS reaches its end of life.
No recompiling or retargeting after move to 4.6.2 or later
.NET developers are recommended to migrate their applications to at least .NET Framework 4.6.2 or later before April 26, 2022, to continue receiving security updates and technical support.
Developers who haven’t already deployed .NET Framework 4.6.2 or later versions of their apps are only required to update the runtime on which the apps are running to at least version 4.6.2 to stay supported.
.NET Framework 4.6.2 (shipped almost five years ago) and .NET Framework 4.8 (shipped two years ago) are both stable runtimes and compatible in-place replacements already “broadly deployed to hundreds of millions of computers via Windows Update (WU).”
“If your application was built to target .NET Framework 4 – 4.6.1, it should continue to run on .NET Framework 4.6.2 and later without any changes in most cases,” Damkewala added, without a need to recompile or retarget.
“That said, we strongly recommend you validate that the functionality of your app is unaffected when running on the newer runtime version before you deploy the updated runtime in your production environment.”
Retired after switch to SHA-2 signing
Microsoft is retiring these .NET Framework versions because they are digitally signed with certificates that use the legacy SHA-1 cryptographic hashing algorithm, which is now insecure.
Security researchers released a report in 2015 on SHA-1’s vulnerability to collision attacks that could enable threat actors to forge digital certificates to impersonate companies or websites.
These forged digital certificates can be used to spoof companies, add legitimacy to phishing messages, or in man-in-the-middle attacks to snoop on encrypted network sessions.
Starting next month, on May 9, all major Microsoft services and processes (including code signing, file hashing, and TLS certificates) will use the SHA-2 algorithm exclusively.
Microsoft also retired all Windows-signed SHA-1 content from the Microsoft Download Center in August 2020, after changing the signing of Windows updates to use the SHA-2 algorithm one year before.
It’s also important to note that, although Microsoft only supports SHA-2-signed content for official content, Windows executables signed using manually installed enterprise or self-signed SHA-1 certificates can still run in the operating system.
Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-announces-end-of-life-for-multiple-net-framework-versions/
