Updates for SharePoint Server Subscription Edition (January 2023 CU)

15 January 2023    |    Comments   Comments: 0

A new cumulative update (January 2023 CU) has been released for SharePoint Server Subscription Edition.

SP Build:
16.0.15601.20418 (Language independent CU)
16.0.15601.20418 (Language dependent CU)

SharePoint Subscription Edition CU – KB articles describing the CU:

  • KB 5002331 – January 2023 Update for SharePoint Server Subscription Edition (language independent)
  • KB 5002326 – January 2023 Update for SharePoint Server Subscription Edition (language dependent)

SharePoint Server Subscription Edition CU – CU download links:

After installation, remember to run the SharePoint Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server Subscription Edition farm, you must reinstall the language-dependent update afterwards.

Note for this CU:

The main update requires the release version of Microsoft SharePoint Server Subscription Edition; the language update also requires Subscription Edition to be installed. KB 5002326 may require a computer restart.

A site URL ending in a string matching a blocked file extension for the web application may prevent access to the site. KB5023406 describes this issue and identifies February 2023 KB 5002353 as the fix for Subscription Edition.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server Subscription Edition

KB 5002331 addresses SharePoint Server remote code execution and security feature bypass vulnerabilities: CVE-2023-21742, CVE-2023-21743, CVE-2023-21744.

The main update, KB 5002331, includes these SharePoint Server fixes:

  • Fixes heap corruption occurring while the HTML parser fixes up links.

  • Fixes an issue where dynamic ordering rules added in the search results web part disappear from the query builder’s Ranking tab.

  • Fixes an issue where document parsing fails for URL encoding containing [].

  • Fixes an issue where SharePoint cannot open Office documents in Office client applications from Mozilla Firefox.

  • Fixes an issue where Office documents in search results cannot open in Office client applications from Google Chrome.

  • Fixes an issue where the modern list view behaves incorrectly.

  • Fixes an issue where a user cannot disable the second-stage recycle bin when their account is not a farm administrator.

  • Fixes an issue where list search omits image results in a non-default zone.

  • Fixes an issue where numbers formatted for German (Switzerland) cannot be interpreted.

  • Fixes an issue where Quick Edit does not work for a Person or Group column when multiple authentication providers are configured.

The following fix requires both KB 5002331 and language update KB 5002326:

  • Fixes an issue where an existing list item cannot be saved in the modern interface if its existing Person field value no longer resolves in Active Directory.

Fixes for other components (requirements are stated with each fix):

  • Project Server, KB 5002331: Fixes an issue where restoring server metadata, such as Enterprise custom fields, starts a Reporting Database Refresh queue job that fails, leaving direct reporting-schema and OData queries without data. The ULS log reports SPValidatingBinder: blocked type Microsoft.Office.Project.Server.BusinessLayer.ReportingLayer.RefreshStorageData denied. The refresh job now completes successfully.

Comments are closed.