Updates for SharePoint Server 2019 (December 2024 CU)

15.12.2024    |    komentáře   komentářů: 0

A new cumulative update (December 2024 CU) has been released for SharePoint Server 2019.

SP Build:
16.0.10416.20026 (Language independent CU)
16.0.10416.20026 (Language dependent CU)

SharePoint 2019 CU – KB articles describing the CU:

  • KB 5002657 – December 2024 Update for SharePoint Server 2019 (language independent)
  • KB 5002664 – December 2024 Update for SharePoint Server 2019 (language dependent)

SharePoint Server 2019 CU – CU download links:

After installation, remember to run the SharePoint 2019 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2019 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB 5002657 and KB 5002664 require the release version of SharePoint Server 2019 to be installed.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2019

KB 5002657 and KB 5002664 address remote code execution, elevation of privilege and information disclosure in SharePoint. The advisories are CVE-2024-49070, CVE-2024-49068, CVE-2024-49064, CVE-2024-49062.

KB 5002657 also addresses remote code execution in Microsoft Office. See CVE-2024-49065.

The language-independent package KB 5002657 includes this SharePoint Server 2019 fix:

  • Fixes an issue where the new SPSerialization allow list prevents pages containing third-party web parts or controls from loading correctly. KB5049566 describes ULS tags 6d3sf or apmev and the message Missed type in new allowlist. Type = <blockedTypeName>. After confirming the blocked type is safe, a farm administrator can add it to SPSerializationCustomizedAllowList with the following commands. Replace <blockedTypeName> with the generic type name, rather than the assembly-qualified name. If the name contains a backtick, enter that character twice so PowerShell interprets it correctly:

    add-pssnapin *
$f = get-spfarm
$f.AddGenericAllowedListValue("SPSerializationCustomizedAllowList", "<blockedTypeName>")
$f.update()
iisreset

The following improvement requires both the language-dependent package KB 5002664 and the language-independent package KB 5002657:

  • Adds a Central Administration banner announcing the end of support for hybrid search based on Search Content Service (SCS).

Komentáře