Updates for SharePoint Server 2016 (September 2024 CU)

15.9.2024    |    komentáře   komentářů: 0

A new cumulative update (September 2024 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5465.1001 (Language independent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002624 – September 2024 Update for SharePoint Server 2016 (language independent)
  • No new language-dependent package was released for this CU. Use the latest available language CU: KB 5002524 (December 2023 CU).

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU for this release)
  2. language-dependent components (latest available language CU: KB 5002524, December 2023 CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB5002624 requires the release version of SharePoint Enterprise Server 2016.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by this update or manually. Without an active contract at enablement, disable this experience.

Custom types inheriting from IDictionary may be blocked during deserialization because they are absent from the allow list; ULS records 4nsby or 4nss4. If this occurs in w3wp.exe, a farm administrator may allow a type only after confirming it is safe. KB5043462 specifies an AllowedItem named AllowedIDictionaryType, with either Type or Assembly, under configuration/SharePoint/SafeMode/AllowedListItems in Web.config.

Workflow publishing may fail because an unauthorized type is blocked, with ULS tag c42q0. Find the blocked type using that tag and confirm both the type and assembly are safe before authorizing it in Web.config, in the System.Workflow.ComponentModel.WorkflowCompiler → authorizedTypes → targetFx section for v4.0. The KB provides this entry:

<authorizedType Assembly="Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" Namespace="Microsoft.SharePoint.WorkflowActions.WithKey" TypeName="*" Authorized="True" />

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB5002624 addresses SharePoint Server remote code execution and denial of service: CVE-2024-38018, CVE-2024-38227, CVE-2024-38228, CVE-2024-43464, CVE-2024-43466.

The core package KB5002624 includes these SharePoint Server fixes:

  • Fixes an issue where SharePoint PowerShell cmdlets malfunction after KB5002618 because Microsoft.SharePoint.ApplicationPages.SPThemes is classified as unsafe in all Web.config files.

  • Fixes an issue where Business Data Connectivity (BDC) features stop working correctly after the latest .NET cumulative updates are installed.

Komentáře