A new cumulative update for SharePoint Server 2016 has been released (October 2019 CU).
This CU includes both Feature Pack 2, which has been included since the September CU (September 2017 CU), and the previous Feature Pack 1.
SP Build:
16.0.4912.1000 (Language independent CU)
16.0.4912.1000 (Language dependent CU)
SharePoint 2016 CU – KB articles describing the CU:
- KB 4484111 – October 2019 Update for SharePoint Server 2016 (language independent)
- KB 4484115 – October 2019 Update for SharePoint Server 2016 (language dependent)
SharePoint Server 2016 CU – CU download link:
- Download October 2019 Update for SharePoint Server 2016 (language independent)
- Download October 2019 Update for SharePoint Server 2016 (language dependent)
After installation, remember to run the SharePoint 2016 Products Configuration Wizard (SharePoint 2016 Products Configuration Wizard), or the following command:
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
Notice
Feature Pack 2 also includes all functionality from Feature Pack 1.
Always install both packages in this order:
- language independent (updates language-independent components)
- language dependent (updates language-dependent components)
For language-dependent packages, it does not matter which language you select, as each package contains updates for all languages.
If you install a new language pack on your SharePoint Server 2016 farm, you must then reinstall the language-dependent update package.
Remember that Distributed Cache must also be updated alongside SharePoint; see How to update Distributed Cache correctly and for Office Online Server, you must have the current RTM release; see How to update Office Online Server.
Included fixes and improvements
The fixes and improvements listed for this CU are excerpts from official Microsoft KB articles in their original language (EN).
SharePoint Server 2016
This security update resolves a spoofing vulnerability that exists if Microsoft SharePoint Server does not correctly sanitize a specially crafted web request to an affected SharePoint server. To learn more about the vulnerability, see the following security advisories:
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1070
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1328
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1329
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1330
In this update, PerformancePoint Dashboard Designer now uses SHA256 digital signatures to verify the authenticity of files.
This security update contains fixes for the following nonsecurity issues in SharePoint Server 2016:
- Fixes a problem with the Convert-SPWebApplication cmdlet when the User Principal Name (UPN) is set as an identifier. Now you will be able to move SharePoint authentication to the Active Directory Federation Services (AD FS) Identity Provider by using following command:
Convert-SPWebApplication -Identity $wa -From CLAIMS-WINDOWS -To CLAIMS-TRUSTED-DEFAULT -TrustedProvider $tp - Fixes the issue that affects access to the host-named site collection if one of the sites is deleted and users lose access to other sites for about a day. Now users will be able to access all the sites by running following command in PowerShell even though one of the sites is deleted:
$config = Get-SPSecurityTokenServiceConfig$config.WindowsModeIgnoreCache = $true$config.Update() - Users who have limited permissions on a list or document library but have approve-level permissions on a folder can now approve multiple items or documents in the folder. To complete the approval, you must select the items in the folder and use the Approve/Reject option on the Ribbon.
- SharePoint patching may copy more folders than are necessary for side-by-side patching. This consumes additional hard drive space. This update fixes the issue by restricting copying to only the folders that are necessary for side-by-side patching.
This security update contains improvements and fixes for the following nonsecurity issues in Project Server 2016:
- Makes changes to display the new Japanese era name for date format samples in Date Format in Project Web App (PWA) sites.
- The OwnerId property is now available to update the project owner through a REST call. The type of this property is String, but it accepts only the user’s numeric ID.
- You cannot delete resource calendar exceptions through the client-side object model (CSOM). This issue occurs after you install update 4464594.
- If the stage status information text contains special characters such as an ampersand (&), workflows fail.
- When the Schedule Variance Percentage (SVP) or Cost Variance Percentage (CVP) earned value becomes very large, this creates an overflow condition. This causes the client-side object model (CSOM) or REST calls that are made while accessing the project to fail. The SVP and CVP values now have a lower limit of “-100%” and upper limit of “100%.”
Komentáře