This month, we are releasing fixes for security vulnerabilities that impact TFS 2015, TFS 2017, TFS 2018, and Azure DevOps Server 2019.
CVE-2019-1305: cross site scripting (XSS) vulnerability in Repos
CVE-2019-1306: remote code execution vulnerability in Wiki
Here are the versions impacted:
Azure DevOps Server 2019 Update 1 Patch 1
If you have Azure DevOps Server 2019 Update 1, you should install Azure DevOps Server 2019 Update 1 Patch 1.
Verifying Installation
To verify if you have this update installed, you can check the version of the following file: [INSTALL_DIR]Application TierWeb ServicesbinMicrosoft.TeamFoundation.Framework.Server.dll. Azure DevOps Server 2019 is installed to c:Program FilesAzure DevOps Server 2019 by default.
After installing Azure DevOps Server 2019.1 Patch 1, the version will be 17.153.29226.8.
Azure DevOps Server 2019.0.1 Patch 3
If you have Azure DevOps Server 2019, you should first update to Azure DevOps Server 2019.0.1. Once on 2019.0.1, install Azure DevOps Server 2019.0.1 Patch 3.
Verifying Installation
To verify if you have this update installed, you can check the version of the following file: [INSTALL_DIR]Application TierWeb ServicesbinMicrosoft.TeamFoundation.Framework.Server.dll. Azure DevOps Server 2019 is installed to c:Program FilesAzure DevOps Server 2019 by default.
After installing Azure DevOps Server 2019.0.1 Patch 3, the version will be 17.143.29226.4.
TFS 2018 Update 3.2 Patch 7
If you have TFS 2018 Update 2 or Update 3, you should first update to TFS 2018 Update 3.2. Once on Update 3.2, install TFS 2018 Update 3.2 Patch 7.
Verifying Installation
To verify if you have this update installed, you can check the version of the following file: [TFS_INSTALL_DIR]Application TierWeb ServicesbinMicrosoft.TeamFoundation.WorkItemTracking.Web.dll. TFS 2018 is installed to c:Program FilesMicrosoft Team Foundation Server 2018 by default.
After installing TFS 2018 Update 3.2 Patch 7, the version will be 16.131.29226.5.
TFS 2018 Update 1.2 Patch 6
If you have TFS 2018 RTW or Update 1, you should first update to TFS 2018 Update 1.2. Once on Update 1.2, install TFS 2018 Update 1.2 Patch 6.
Verifying Installation
To verify if you have this update installed, you can check the version of the following file: [TFS_INSTALL_DIR]Application TierWeb ServicesbinMicrosoft.TeamFoundation.Server.WebAccess.Admin.dll. TFS 2018 is installed to c:Program FilesMicrosoft Team Foundation Server 2018 by default.
After installing TFS 2018 Update 1.2 Patch 6, the version will be 16.122.29226.6.
TFS 2017 Update 3.1 Patch 8
If you have TFS 2017, you should first update to TFS 2017 Update 3.1. Once on Update 3.1, install TFS 2017 Update 3.1 Patch 8.
Verifying Installation
To verify if you have a patch installed, you can check the version of the following file: [TFS_INSTALL_DIR]Application TierWeb ServicesbinMicrosoft.TeamFoundation.Server.WebAccess.Admin.dll. TFS 2017 is installed to c:Program FilesMicrosoft Team Foundation Server 15.0 by default.
After installing TFS 2017 Update 3.1 Patch 8, the version will be 15.117.29226.0.
TFS 2015 Update 4.2 Patch 3
If you have TFS 2015, you should first update to TFS 2015 Update 4.2. Once on Update 4.2, install TFS 2015 Update 4.2 Patch 3.
Verifying Installation
To verify if you have a patch installed, you can check the version of the following file: [TFS_INSTALL_DIR]Application TierWeb ServicesbinMicrosoft.TeamFoundation.Framework.Server.dll. TFS 2015 is installed to c:Program FilesMicrosoft Team Foundation Server 14.0 by default.
After installing TFS 2015 Update 4.2 Patch 3, the version will be 14.114.29226.0.
The post September patches for Azure DevOps Server and Team Foundation Server appeared first on Azure DevOps Blog.