.NET Framework June 2021 Security and Quality Rollup Updates

13 comments

Discussion is closed. Login to edit/delete existing comments.

• 

  Kalle Niemitalo June 9, 2021 3:48 am 0

  collapse this comment copy link to this comment

  The “Security” section says:

  “The February Security and Quality Rollup Update does not contain any new security fixes. See February 2021 Security and Quality Rollup for the latest security updates.”

  Should it instead say the following?

  “The June Security and Quality Rollup Update does not contain any new security fixes. See February 2021 Security and Quality Rollup for the latest security updates.”

  • 

    Tara Overfield June 9, 2021 7:19 am 0

    collapse this comment copy link to this comment

    Thanks for catching that typo Kalle! I have corrected the issue and re-published the post.

• 

  Alfred Ardito June 10, 2021 10:21 am 0

  collapse this comment copy link to this comment

  Does this update supersede KB4601051 (February update)? I noticed after installing this months update, that in the registry and cbs.log, the February update is marked as superseded. But when looking at the catalog online it doesn’t mention that.

  • 

    Tara Overfield June 15, 2021 1:24 pm 0

    collapse this comment copy link to this comment

    Installing the June Security and Quality rollup from Windows Update will supersede previous releases, including the February Security and Quality rollup. If you install updates from WSUS or Catalog the June Security and Quality rollup will not supersede the February Security and Quality rollup. This supersedence strategy allows Windows Update to offer only the latest update and allows WSUS and Catalog customers to choose the latest security release or the latest release when there is no new security improvements.

    • 

      logie loge July 1, 2021 8:11 am 0

      collapse this comment copy link to this comment

      Hi Tara,

      Historically, my organisation has deployed packages containing multiple .NET security updates that have been downloaded from the update catalog, including the latest rollup at the time.

      However, my understanding is that the latest rollup is cumulative and includes all previous security fixes therefore, if I have a fresh install of .NET, I shouldn’t need to install any .NET security updates besides the most recent rollup. As things stand currently, this would be the June security rollup which contains all previous security updates (the latest being from Feb ‘21). I’d like to confirm that I have got this correct.

      I did ask a question on the Microsoft Help forum to confirm whether my understanding is correct but I didn’t get a definite response and there were suggestions of installing earlier updates as well as the latest roll up. Please could you advise if I am correct in my understanding?

      For info, my Help forum post is here.

      Many thanks.

      • 

        Tara Overfield July 1, 2021 10:01 am 0

        collapse this comment copy link to this comment

        Hi Logie,
        You are correct in your understanding. The latest rollup is cumulative and includes all previous security fixes. If you have a fresh install of .NET, then install the latest rollup update you will be up-to-date. Currently, the latest update is the June Security and Quality Rollup (which does contain the latest security fixes from Feb ’21).

        • 

          logie loge July 2, 2021 2:25 am 0

          collapse this comment copy link to this comment

          Thanks for the reply, Tara. Much appreciated.

• 

  Mystery Man June 12, 2021 4:16 am 0

  collapse this comment copy link to this comment

  Why does this update not appear on the .NET Update History page?

  • 

    Tara Overfield June 15, 2021 1:25 pm 0

    collapse this comment copy link to this comment

    Thanks for reporting this, the issue has been fixed on the .NET Update History page.

• 

  Felipe Pessoto June 12, 2021 2:46 pm 0

  collapse this comment copy link to this comment

  Tara, how can I know if I’m affected by this issues: “Addresses an issue where a background GC could pause the runtime for a long period of time if a large managed heap is filled with long lived objects with a deep chain of references.”?

  Thanks

  • 

    Ian Yates June 16, 2021 2:22 am 0

    collapse this comment copy link to this comment

    Agree. Good question. Is there any information about these circumstances so we can determine if this change may help? Even if not, such details are always good to read. Would you be able to point us to a blog post, or a similar fix that may have landed in .net core?

    Also, do we need to opt in to tls 1.3 at all? What setting might govern the opt-in, or opt-out of this change? I just had to set an enum flags value earlier this week to opt-in to tls 1.2 to get a particular web service working so I’m very curious to know if I could extend this enum flags further, or if I don’t need to touch it.

    Thanks

  • 

    Tara Overfield June 18, 2021 3:53 pm 0

    collapse this comment copy link to this comment

    When this uncommon issue is experienced you may use a profiler (e.g. PerfView) to determine whether or not you are affected by the underlying issue. In particular, you should see: 1) A long GC pause, 2) That long GC pause is associated with a background GC and 3) observe some ETW events of this type (Microsoft-Windows-DotNETRuntimePrivate/GC/BGCOverflow) emitted from the runtime.

    • 

      Felipe Pessoto June 25, 2021 1:13 pm 0

      collapse this comment copy link to this comment

      Thanks Tara!