Updates for SharePoint Server Subscription Edition (December 2024 CU)

15 December 2024    |    Comments   Comments: 0

A new cumulative update (December 2024 CU) has been released for SharePoint Server Subscription Edition.

SP Build:
16.0.17928.20290

Starting with the March 2023 CU, updates for SharePoint Server Subscription Edition are released as a single package (known as an Uber package) containing both language-independent and language-dependent fixes. Only one package needs to be installed to fully update the server.

SharePoint Subscription Edition CU – KB articles describing the CU:

  • KB 5002658 – December 2024 Update for SharePoint Server Subscription Edition

SharePoint Server Subscription Edition CU – CU download links:

After installation, remember to run the SharePoint Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

To speed up CU installation, I recommend following the guidance in How to speed up CU installation in SharePoint Server Subscription Edition.

The language you select when downloading the update does not matter because the same package is downloaded for every language.

Note for this CU:

Installing this update requires the release version of SharePoint Server Subscription Edition.

For the third-party control issue described in KB5049566, ULS events 6d3sf or apmev identify the blocked type. After confirming the type is safe, a farm administrator can add it to SPSerializationCustomizedAllowList. The blockedTypeName parameter takes the generic type name, not the assembly-qualified name; double any backtick in the value so PowerShell interprets it correctly. Replace the placeholder with that name:

add-pssnapin *
$f = get-spfarm
$f.AddGenericAllowedListValue("SPSerializationCustomizedAllowList", "<blockedTypeName>")
$f.update()
iisreset

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server Subscription Edition

This CU addresses remote code execution, elevation of privilege and information disclosure vulnerabilities: CVE-2024-49070, CVE-2024-49068, CVE-2024-49064, CVE-2024-49062.

The unified update in KB 5002658 includes these SharePoint Server Subscription Edition fixes:

  • Fixes an issue where the new SPSerialization allow list prevents pages containing third-party web parts or controls from loading. See KB5049566 and the procedure above.

  • Fixes an issue where changing browser zoom makes command bar controls disappear.

  • Fixes an issue where folders cannot be uploaded when their names contain similar characters from an extended supported character range.

  • Fixes an issue where tiles in the Hero web part cannot be reordered.

Comments are closed.