NOTICE (Nov27): The SUs have been re-released. The v2 adds additional control over the X-MS-Exchange-P2FromRegexMatch header, which is set for messages with a non-RFC5322 compliant P2 FROM header. Install these on your Exchange server, also if you already deployed the v1 SU to benefit from the additional control.
The Exchange product group released November 2024 updates for Exchange Server 2016 and 2019.
The vulnerabilities addressed in these Security Updates for Exchange Server are:
| Vulnerability | Category | Severity | Rating |
|---|---|---|---|
| CVE-2024-49040 | Spoofing | Important | CVSS:3.1 7.5 / 6.7 |
The v2 Security Updates for each supported Exchange Server build are linked below:
| Exchange | Download | Build | KB | Supersedes |
|---|---|---|---|---|
| Exchange 2019 CU14 | Download | 15.2.1544.14 | KB5044062 KB5049233 | KB5036401 |
| Exchange 2019 CU13 | Download | 15.2.1258.39 | KB5044062 KB5049233 | KB5036402 |
| Exchange 2016 CU23 | Download | 15.1.2507.44 | KB5044062 KB5049233 | KB5036386 |
Added Features
Anti-Malware Scan Interface (AMSI) integration
The ability of products that use the Exchange Server AMSI integration to perform additional tasks on message bodies. The feature is disabled by default. You can enable it on a protocol base like Exchange Web Services or PowerShell. More information on this feature here.
Non-RFC5322 compliant header detection
Similar to the change in Exchange Online mentioned in MC886603, after installing this SU, messages with a non-compliant P2 FROM header (RFC5322) will be detected. Unlike Exchange Online, which will drop these messages, Exchange will add a header that can be used in transport rules as organizations see fit. To be compliant, organizations should ensure messages with multiple From addresses include a Sender header. More information here.
Elliptic Curve Cryptography (ECC) certificate support
ECC certificates can now be used on Edge Transport servers and bound to the POP and IMAP services. Note that unlike the previous implementation, which required enabling using New-SettingOverride, they are now configured through a registry key, i.e.
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Diagnostics" -Name "EnableEccCertificateSupport" -Value 1 -Type String
More information here.
Microsoft Information Protection Client (MSIPC)
MSIPC will now ne enabled by default, replacing Microsoft Digital Rights Management (MSDRM) for information rights management.
Fixed Issues
Apart from security fixes and added features, these Security Updates also correct the following issues:
Notes
- Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU14 to Exchange 2019 CU13. When downloading, the security update will carry the same name for different Cumulative Updates, and I suggest tagging the file name with the CU level when archiving it, e.g., Exchange2019-CU14-KBXXXXXX-x64-en.msp.
- Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
- If you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management, it is recommended that you apply the Security Update. Be aware of a few cmdlet piping issues mentioned here.
On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates and follow a more agile approach; the ratings indicate the level of urgency.
EighTwOne (821) 