Updates for SharePoint Server 2019 (September 2022 CU)

A new cumulative update (September 2022 CU) has been released for SharePoint Server 2019.

SP Build:
16.0.10390.20000 (Language independent CU)
16.0.10390.20000 (Language dependent CU)

SharePoint 2019 CU – KB articles describing the CU:

• KB 5002258 – September 2022 Update for SharePoint Server 2019 (language independent)
• KB 5002257 – September 2022 Update for SharePoint Server 2019 (language dependent)

SharePoint Server 2019 CU – CU download links:

• Download September 2022 Update for SharePoint Server 2019 (language independent)
• Download September 2022 Update for SharePoint Server 2019 (language dependent)

After installation, remember to run the SharePoint 2019 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

1. language independent components (core CU)
2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2019 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

Installation requires the release version of SharePoint Server 2019.

Some Web Part Pages Web Service methods can be blocked after this update. See KB5017733.

The checks in RenderWebPartForEdit reject controls with . used for property traversal in attribute values. ULS tags 6loz1 and 5mh3d identify blocked controls. Only after reviewing a control’s security, add or amend its SafeControl entry under Configuration/SharePoint/SafeControls in the web application’s web.config with AllowPropertiesTraversal="True". Standard SharePoint features without custom components should work with the defaults; report affected standard features to Microsoft support. Assess the security risk before weakening these checks and apply appropriate protection.

Some SharePoint 2010 workflows can be blocked. KB5017760 describes the enhanced security policy.

Types in System.Workflow.Activities and System.Workflow.ComponentModel are now authorized individually rather than trusting every type in these assemblies. ULS tags c42q8, c42ra and c42rh identify related failures. If a workflow needs a type that is no longer authorized, review its security before adding it to configuration/System.Workflow.ComponentModel.WorkflowCompiler/authorizedTypes in the web application’s Web.config. Evaluate the risks and maintain appropriate protection. Standard features without custom components should not require configuration changes; ask Microsoft support to investigate any such failures.

Customers using Document Generation in Nintex Workflow must take additional action after installation so workflows can be published and run. Follow Nintex’s instructions and contact Nintex for support.

Nintex instructs administrators to authorize ArrayExtension and TypeExtension from System.Workflow.ComponentModel versions 3.0.0.0 and 4.0.0.0 in every SharePoint web application’s web.config, using Namespace="System.Workflow.*", PublicKeyToken=31bf3856ad364e35 and Authorized="True" in the authorizedTypes configuration section under targetFx. Then perform IISReset; restarting OWSTimer may also be needed if workflows execute in the timer service process. The Nintex page provides the four exact XML entries and an accompanying PowerShell script.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2019

• The update addresses a SharePoint remote code execution vulnerability tracked as CVE-2022-37961.

• The update addresses a SharePoint remote code execution vulnerability tracked as CVE-2022-38008.

• The update addresses a SharePoint remote code execution vulnerability tracked as CVE-2022-38009.

• The update addresses a SharePoint remote code execution vulnerability tracked as CVE-2022-35823.

The update corrects the following SharePoint Server 2019 issue:

• During content processing, Language Detection could receive an incorrect hint.

The following feature and fixes require both KB 5002257 and KB 5002258 for complete functionality:

• SharePoint Server 2019 gains an End of Support Notification feature.

• Renaming a file or folder could fail when its URL included double-byte characters.

• A missing version hash for JavaScript files could prevent the left navigation pane or Quick Launch menu from appearing.

• On modern pages, lazy loading could produce an incorrectly rendered web part.

• Replacing a document with another document of the same name could leave its list item properties impossible to set.

• If any required fields were left empty, the people column of type Person or Group could show a User ID in place of the person’s name.

• In Project Server, resource updates through the client-side object model (CSOM) could fail when a remote event handler was connected to a resource event, for example Resource Changing.