A new cumulative update (March 2024 CU) has been released for SharePoint Server Subscription Edition.
SP Build:
16.0.17328.20136
Starting with the March 2023 CU, updates for SharePoint Server Subscription Edition are released as a single package (known as an Uber package) containing both language-independent and language-dependent fixes. Only one package needs to be installed to fully update the server.
SharePoint Subscription Edition CU – KB articles describing the CU:
- KB 5002564 – March 2024 Update for SharePoint Server Subscription Edition
SharePoint Server Subscription Edition CU – CU download links:
After installation, remember to run the SharePoint Products Configuration Wizard or the following command:
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
Important notes
To speed up CU installation, I recommend following the guidance in How to speed up CU installation in SharePoint Server Subscription Edition.
The language you select when downloading the update does not matter because the same package is downloaded for every language.
Note for this CU:
Installing this update requires the release version of SharePoint Server Subscription Edition.
Adding a server can fail when the farm has a certificate managed by Certificate Management. Certificate deployment now relies on SharePoint Timer Service (SPTimerv4), which is unavailable on the joining server; the error reports that spadminv4 cannot be contacted. Microsoft identifies May 2024 KB5002599 as the fix in KB5037978.
This update changes Microsoft.Owin. The upgrade described above must register the new version in Web.config; until then, SharePoint sites can fail with a file or assembly loading error referencing Microsoft.Owin, Version=3.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35. Completing the upgrade resolves the error. This is intentional and affects zero downtime patching: plan a maintenance window that allows downtime unless you apply Microsoft’s manual configuration procedure below.
To maintain availability, edit Web.config for every web application immediately after installing the update on each server, before returning that server to load balancing. Under configuration > runtime > assemblyBinding, find the dependentAssembly for Microsoft.Owin with publicKeyToken="31bf3856ad364e35" and culture="neutral". In its bindingRedirect, change oldVersion="0.0.0.0-3.0.1.0" to oldVersion="0.0.0.0-4.2.2.0" and newVersion="3.0.1.0" to newVersion="4.2.2.0". Keep the assembly identity unchanged. After updating all servers, run the upgrade; these manual edits do not interfere with it.
Included fixes and improvements
The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.
SharePoint Server Subscription Edition
This CU addresses a remote code execution vulnerability: CVE-2024-21426.
The unified update in KB 5002564 includes these SharePoint Server Subscription Edition changes:
-
Adds the Version 24H1 feature update, which is also included in subsequent SPSE public updates.
-
Adds the option to disable the CSP HTTP header on SharePoint Pages. To disable it, run in PowerShell:
Add-PSSnapin Microsoft.SharePoint.PowerShell $farm = Get-SPFarm $farm.EnableCSPHeaderForPage = $false $farm.Update() -
Fixes an issue where the modern List web part freezes after See all is selected in a grouped view when the site URL contains
'. -
Fixes an issue where the Edit button covers the multiline field title in the list item editing pane for right-to-left (RTL) languages.
-
Fixes an issue where horizontal navigation on a communication site misrepresents the current site.
-
Fixes an issue where site theme customization adds a 5-second delay while the sign-in form loads.
-
Fixes an issue where Quick Edit displays plain text as a hyperlink.
-
Fixes an issue where the classic interface reports an incorrect subsite status.