April Security Release: Patches available for Azure DevOps Server 2019, TFS 2018.3.2, TFS 2018.1.2, TFS 2017.3.1, and the release of TFS 2015.4.2

27 comments

Discussion is closed. Login to edit/delete existing comments.

• 

  Daniel Steiner April 9, 2019 10:16 am 0

  collapse this comment copy link to this comment

  why do I need to login to see the CVEs but a normal Live account does not work?

  • 

    Grant Holliday April 9, 2019 11:55 am 0

    collapse this comment copy link to this comment

    This is an error. We are working on updating the links to public versions.

    • 

      Erin Dormier April 9, 2019 12:38 pm 0

      collapse this comment copy link to this comment

      The links are updated now. Sorry about that.

• 

  Long Pham April 9, 2019 1:54 pm 0

  collapse this comment copy link to this comment

  For TFS 2015 Update 4.2 is there an express version available? tfsexpress2015.4.2.exe

  • 

    Erin Dormier April 9, 2019 7:15 pm 0

    collapse this comment copy link to this comment

    I just updated the post with the links for TFS 2015 Update 4.2 Express. The web install is at https://go.microsoft.com/fwlink/?linkid=844070. Thanks!

    • 

      Long Pham April 10, 2019 10:25 am 0

      collapse this comment copy link to this comment

      Thanks for the link. The install failed with “A setup package is either missing or damaged.” Since this is a web installer looks like its failing to download some packages during install. thanks,

      • 

        Erin Dormier April 15, 2019 10:00 am 0

        collapse this comment copy link to this comment

        I’m taking a look. In the meantime, can you get unblocked by downloading the ISO?

        • 

          Bob S. April 16, 2019 7:55 am 0

          collapse this comment copy link to this comment

          Had the same issue with the TFS 2015 Web Install, had to use the ISO to update without the error.

• 

  Daniel Stefanescu April 9, 2019 9:20 pm 0

  collapse this comment copy link to this comment

  Tried to apply the patch on a TFS2018 Update 3.2 Patch 2:Error patching files: System.UnauthorizedAccessException: Access to the path ‘C:\Program Files\Microsoft Team Foundation Server 2018\Application Tier\TFSJobAgent\Microsoft.TeamFoundation.DistributedTask.Orchestration.Server.dll’ is denied.

  • 

    Daniel Stefanescu April 9, 2019 9:46 pm 0

    collapse this comment copy link to this comment

    The current version of C:\Program Files\Microsoft Team Foundation Server 2018\Application Tier\Web Services\bin\Microsoft.TeamFoundation.WorkItemTracking.Web.dll is 16.131.28626.3 (I applied yesterday tfs2018.3.2patch2.exe)

    • 

      Erin Dormier April 10, 2019 7:49 am 0

      collapse this comment copy link to this comment

      Hi Daniel,

      For TFS 2018 Update 3.2, it should be patch 3. Can you confirm you installed tfs2018.3.2patch3.exe, not patch2? Are you still having the System.UnauthorizedAccessException issue?

• 

  Corné Wevers April 10, 2019 12:39 am 0

  collapse this comment copy link to this comment

  Hi, I just installed this patch on two of our test Azure Devops 2019 servers. On both servers the installation succeeded but it encountered a timeout exception while waiting for the application pool to have succesfully stopped. It doesn’t seem to correctly detect that the pool has stopped so it’ll hit the timeout. When retrying it’ll instantly detect that the pool has stopped and continue with applying the patch.

  • 

    Erin Dormier April 10, 2019 9:34 am 0

    collapse this comment copy link to this comment

    Hello Corné,

    I found out some information from my collegue, Matt.

    Sorry that you ran into problems with the install.  There are some rare cases where we don’t correctly detect that everything has stopped.  In those cases, re-running the patch is the correct response, and it will correctly update the files and then restart the server.

• 

  Markus April 10, 2019 2:42 am 0

  collapse this comment copy link to this comment

  When will be the groundbreaking feature implemented for an unattend installation from patches?

  • 

    Erin Dormier April 10, 2019 7:45 am 0

    collapse this comment copy link to this comment

    🙂 We expect it to be available for the May security release. 

• 

  Giulio Vian April 10, 2019 4:09 am 0

  collapse this comment copy link to this comment

  @Erin, will these patches included in the ISO images downloadable from MSDN etc? If so, will take a long time? TIA

  • 

    Erin Dormier April 10, 2019 7:46 am 0

    collapse this comment copy link to this comment

    Hi Giulio,

    No, these won’t be included in the MSDN/VS Subscription ISOs. You’ll have to apply these patches over the installations you do with the VS subscription ISOs.

    • 

      Markus April 10, 2019 11:01 pm 0

      collapse this comment copy link to this comment

      But only the latest patch, all predecessors are included, right?

      • 

        Erin Dormier April 15, 2019 10:00 am 0

        collapse this comment copy link to this comment

        Correct. All of the patches include all the fixes from previous patches.

• 

  ADITYA JAMKHANDE April 10, 2019 6:50 am 0

  collapse this comment copy link to this comment

  Hello Erin,

  Thank you for the detailed description. I have a question which may sound silly. But are these patches applicable on the cloud or on the on prem environment?
  Thank you

  • 

    Erin Dormier April 10, 2019 7:44 am 0

    collapse this comment copy link to this comment

    Hi Aditya,

    These are only applicable to the on premises environments. All vulnerabilities that impacted our cloud service have already been addressed, so no action is needed for the service.

    • 

      ADITYA JAMKHANDE April 11, 2019 12:05 am 0

      collapse this comment copy link to this comment

      Hello Erin,
      Thank you so much for the prompt response.

• 

  Mills, Charles April 15, 2019 11:12 am 0

  collapse this comment copy link to this comment

  I ran this against our server with 2017 3.1 and we now get an error starting up the TFS administration console saying that “There was an exception while launching the Team Foundation Administration Console: Could not load file or assembly ‘Microsoft.TeamFoundation.Framework.Server, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a’ or one of its dependencies. The located assembly’s manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)”. Any thoughts?

• 

  Kelly, John April 16, 2019 10:12 am 0

  collapse this comment copy link to this comment

  Everytime I run one of these patches for 2017 the output is a bunch of “Waiting on process NNNNN (XXX seconds elapsed)” for several minutes, sporadic exceptions, waiting for the pool to stop for several more minutes, a final flurry of activity I suspect is that actual update running, and then the installer completes. I expect it to take several minutes and throw several exceptions and yet still ‘succeed’.
  Are the 2018 and 2019 installers markedly better than the 2017 installer in this regard? Is this motivation to move to 2019 or just what I should expect with these installs?

• 

  Иван Мидович April 17, 2019 5:24 am 0

  collapse this comment copy link to this comment

  Why you not update version in console TFS?..