Describe your environment.

• SDK version: 2.14.0
• .NET runtime version (.NET or .NET Core, TargetFramework in the .csproj file): netcoreapp3.1
• Hosting Info (IIS/Azure WebApps/etc): IIS
• Platform and OS version: Windows Server 2019

Steps to reproduce.
Add Microsoft.ApplicationInsights.AspNetCore reference to your project. Look at transitive dependencies.

What is the expected behavior?
Reference to version of Microsoft.AspNetCore.Hosting without known security vulnerabilities (maybe latest from 1.0.x ?)

What is the actual behavior?
Reference to Microsoft.AspNetCore.Hosting 1.0.2 which is a version with security vulnerability.

Additional context.
I understand that this is probably can be fixed by using latest version of runtime in hosting, but this gets reported by security scanners as vulnerability in the project, so it is still good idea to use references on libraries without known security vulnerabilities.