.NET Framework July 2020 Security and Quality Rollup Updates

Tara Overfield

Tara

Revised 6/8/2021: On June 8th, 2021, this update was released to replace a previous update to address a “revocation server was offline” error that may occur during installation. If you’ve already installed a previous release of this update, no action is required.

Revised 4/15/2021: On April 13th, 2021, this update was released to replace a previous release of this some updates. See known issues section for more details. If you’ve already installed a previous release of an affected update, no action is required.

On July 23, 2020, updates KB4565616 v2, KB4565623 v2, KB4565636 v2, KB4565583 v2, KB4565586 v2 and KB4565589 v2 were released to replace v1 of those updates for .NET Framework 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, and 4.8 for Windows 7 Service Pack 1 (SP1), Windows Server 2008 R2 SP1 and Windows Server 2008 Service Pack 2 (SP2). The v1 updates did not install for customers who had certain ESU configurations. The v2 updates correct the issue for customers who could not install the v1 updates.

If you have already installed v1 of these updates, no action is necessary.

To obtain v2 of these updates, see the “How to obtain and install the update” section of the individual update article. Links to each article are found in the “Additional information about this update section” of the KB article.

 

Today, we are releasing the July 2020 Security and Quality Rollup Updates for .NET Framework.

Security

CVE-2020-1147– .NET Framework Remote Code Execution Vulnerability

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content.

To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

The security update addresses the vulnerability by correcting how .NET Framework, Microsoft SharePoint, and Visual Studio validates the source markup of XML content.

Additional Information

This security update affects how .NET Framework’s System.Data.DataTable and System.Data.DataSet types read XML-serialized data. Most .NET Framework applications will not experience any behavioral change after the update is installed. For more information on how the update affects .NET Framework, including examples of scenarios which may be affected, please see the DataTable and DataSet security guidance document.

Known Issue in This Security Update

Symptom Customers using Windows 7 SP1, Windows Server 2008 R2 SP1 or Windows Server 2008, this update does not install, and it returns either or both of the following error messages:

  • -2146762495
  • A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
  • The revocation function was unable to check revocation because the revocation server was offline.

Workaround

This issue was corrected by the latest release of this update. If you’ve already installed a previous release of this update, no action is required.

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog. The Security Only Update is available via Windows Server Update Services and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, NET Framework 4.8 updates are available via Windows Update, Windows Server Update Services, Microsoft Update Catalog. Updates for other versions of .NET Framework are part of the Windows 10 Monthly Cumulative Update.

Note: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.

The following table is for Windows 10 and Windows Server 2016+ versions.

Product Version Cumulative Update
Windows 10 2004 and Windows Server, version 2004
.NET Framework 3.5, 4.8 Catalog 4565627
Windows 10 1909 and Windows Server, version 1909
.NET Framework 3.5, 4.8 Catalog 4565633
Windows 10 1903 and Windows Server, version 1903
.NET Framework 3.5, 4.8 Catalog 4565633
Windows 10 1809 (October 2018 Update) and Windows Server 2019 4566516
.NET Framework 3.5, 4.7.2 Catalog 4565625
.NET Framework 3.5, 4.8 Catalog 4565632
Windows 10 1803 (April 2018 Update)
.NET Framework 3.5, 4.7.2 Catalog 4565489
.NET Framework 4.8 Catalog 4565631
Windows 10 1709 (Fall Creators Update)
.NET Framework 3.5, 4.7.1, 4.7.2 Catalog 4565508
.NET Framework 4.8 Catalog 4565630
Windows 10 1703 (Creators Update)
.NET Framework 3.5, 4.7, 4.7.1, 4.7.2 Catalog 4565499
.NET Framework 4.8 Catalog 4565629
Windows 10 1607 (Anniversary Update) and Windows Server 2016
.NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4565511
.NET Framework 4.8 Catalog 4565628
Windows 10 1507
.NET Framework 3.5, 4.6, 4.6.1, 4.6.2 Catalog 4565513

The following table is for Windows 8.1 and Windows Server 2012 R2 and earlier versions.

Product Version Security and Quality Rollup Security Only Update
Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2 4566519 4566468
.NET Framework 3.5 Catalog 4565613 Catalog 4565580
.NET Framework 4.5.2 Catalog 4565614 Catalog 4565581
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4565622 Catalog 4565585
.NET Framework 4.8 Catalog 4565635 Catalog 4565588
Windows Server 2012 4566518 4566467
.NET Framework 3.5 Catalog 4565610 Catalog 4565577
.NET Framework 4.5.2 Catalog 4565615 Catalog 4565582
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4565621 Catalog 4565584
.NET Framework 4.8 Catalog 4565634 Catalog 4565587
Windows 7 SP1 and Windows Server 2008 R2 SP1 4566517 4566466
.NET Framework 3.5.1 Catalog 4565612 Catalog 4565579
.NET Framework 4.5.2 Catalog 4565616 Catalog 4565583
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4565623 Catalog 4565586
.NET Framework 4.8 Catalog 4565636 Catalog 4565589
Windows Server 2008 4566520 4566469
.NET Framework 2.0, 3.0 Catalog 4565611 Catalog 4565578
.NET Framework 4.5.2 Catalog 4565616 Catalog 4565583
.NET Framework 4.6 Catalog 4565623 Catalog 4565586

 

Previous Monthly Rollups

The last few .NET Framework Monthly updates are listed below for your convenience:

* May 2020 Security and Quality Rollup Updates * March 2020 Update for Windows 10 1607 (Anniversary Update) and Windows Server 2016 * February 2020 Preview of Quality Rollup for Windows 10 1909, Windows 10 1903, Windows Server, version 1909 and Windows Server, version 1903 * February 2020 Preview of Quality Rollup

0 comments

Comments are closed. Login to edit/delete your existing comments