Difference vulnerability between .net core and .net framework

Question

I don't understand why with the old .net Framework, the recomandation for vulnerability is to update only windows and not the nuget package. But for the .net core, the recommandation is to update nuget package. I search are an article that explain the difference between fix vulnerability between .net core and .net framwork.

Sample:

https://www.cvedetails.com/cve/CVE-2018-8421/ (only update Windows, why not nuget too ?) https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8356 (update nuget for .net core, update OS for .net framework)

Answer 1

The full .NET Framework at it's core does not have NuGet packages. It's one block of Framework that you got with your operating system. You can write a fully functional program without a single package. So if there is a vulnerability, you have to update this block that comes with your operating system.

.NET Core is a huge collection of NuGet packages at it's core. It does not come installed as one huge block. So you can update only a few packages. There is nothing that would come with the operating system that you could update.