We've recently been informed by an automated dependency scan that AspNetCore.Http 2.2.x is affected by CVE-2020-1045
.
This CVE was resolved in AspNetCore.Http 2.1.x but not in AspNetCore.Http 2.2.x. This is apparently because the 2.2.x track went EOL before 2.1.x.

From my understanding thus far, this CVE may also be ignored when .NET Core app 3.1 or greater is used. This is still to be confirmed.

Given that our project uses multi-targeting, one target being netstandard2.0 and another being netcoreapp3.1, this PR only addresses the vulnerability in the netstandard2.0 target. This PR does this by downgrading our AspNetCore dependencies to the 2.1.x track, and pinning to the AspNetCore.Http version with the CVE fix.

Question: do we need to backport this change to DF V1?

Issue describing the changes in this PR

resolves N/A

Pull request checklist

• My changes do not require documentation changes
  • Otherwise: Documentation PR is ready to merge and referenced in pending_docs.md
• My changes should not be added to the release notes for the next release
  • Otherwise: I've added my notes to release_notes.md
• My changes do not need to be backported to a previous version
  • Otherwise: Backport tracked by issue/PR #issue_or_pr
• I have added all required tests (Unit tests, E2E tests)
• My changes do not require any extra work to be leveraged by OutOfProc SDKs
  • Otherwise: That work is being tracked here: #issue_or_pr_in_each_sdk
• My changes do not change the version of the WebJobs.Extensions.DurableTask package
  • Otherwise: major or minor version updates are reflected in /src/Worker.Extensions.DurableTask/AssemblyInfo.cs
• My changes do not add EventIds to our EventSource logs
  • Otherwise: Ensure the EventIds are within the supported range in our existing Windows infrastructure. You may validate this with a deployed app's telemetry. You may also extend the range by completing a PR such as this one.