Updates for SharePoint Server 2016 (September 2022 CU)

18.9.2022    |    komentáře   komentářů: 0

A new cumulative update (September 2022 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5361.1002 (Language independent CU)
16.0.5361.1000 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002269 – September 2022 Update for SharePoint Server 2016 (language independent)
  • KB 5002142 – September 2022 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

Both updates require the release version of SharePoint Enterprise Server 2016.

Enabling the modern OneDrive for Business experience, through this update or manually, requires active Software Assurance at that time. If that requirement is not met, disable the modern experience.

KB 5002269 and KB 5002142 can block some Web Part Pages Web Service methods. See KB5017733 and the workaround below.

Security checks in RenderWebPartForEdit block controls with the property traversal character . in attribute values. Find the affected control using ULS tags 6loz1 and 5mh3d. Only after a security review confirms that traversal is safe for that control, locate or add its <SafeControl> entry under <Configuration/SharePoint/SafeControls> in the web application’s web.config and set AllowPropertiesTraversal="True". This workaround lowers security; assess the environment’s risks and apply additional protection. Standard SharePoint features without custom code should work with the default configuration; report any failures there to Microsoft Support.

KB 5002269 can block some SharePoint 2010 workflows. See KB5017760.

SharePoint no longer authorizes every type in System.Workflow.Activities and System.Workflow.ComponentModel by default. ULS tags c42q8, c42ra and c42rh identify affected workflows. If a workflow needs a type that is no longer authorized, first review that type’s security in your environment, then add it under <configuration/System.Workflow.ComponentModel.WorkflowCompiler/authorizedTypes> in the web applications’ Web.config. Assess the security reduction and provide additional protection. Without custom code or components, the default configuration should support standard features; ask Microsoft Support to investigate failures in that configuration.

The September change affects Document Generation in Nintex Workflow and requires additional action to keep workflows publishable and runnable. Follow the vendor procedure linked by Microsoft; Nintex provides product support.

For the Nintex publishing or execution failure, which can affect Document Generation and other actions, add these entries to every SharePoint web application’s web.config, in the authorizedTypes section under targetFx:

<authorizedType Assembly="System.Workflow.ComponentModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Namespace="System.Workflow.*" TypeName="ArrayExtension" Authorized="True" />
<authorizedType Assembly="System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Namespace="System.Workflow.*" TypeName="ArrayExtension" Authorized="True" />
<authorizedType Assembly="System.Workflow.ComponentModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Namespace="System.Workflow.*" TypeName="TypeExtension" Authorized="True" />
<authorizedType Assembly="System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Namespace="System.Workflow.*" TypeName="TypeExtension" Authorized="True" />

Then perform an IISReset. Restarting OWSTimer may also be necessary if workflows execute in the timer service process.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB 5002269 addresses remote code execution vulnerabilities in SharePoint and SharePoint Server: CVE-2022-37961, CVE-2022-38008, CVE-2022-38009, CVE-2022-35823.

KB 5002142 also fixes the SharePoint Server remote code execution vulnerability CVE-2022-38008 listed above.

The following feature requires both KB 5002269 and the language-dependent package KB 5002142:

  • Adds an End of Support Notification feature for SharePoint Server 2016.

Komentáře