May 14, 2024-KB5037926 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607 and Windows Server 2016

CLR₁

- Addresses an issue where crashes can occur if several threads all concurrently query the ITypeInfo implementation of the same managed type

.NET Libraries

- Addresses an issue where 32-bit platform show a significant response time regression.

- Addresses an issue to use MIST validated implementations of FIPS algorithms.

.NET Fundamentals

- Addresses an issue with wildcard format changes introduced in IIS 10.

WPF₂

- Addresses an issue where apps crash when calling GetWindowText and GetWindowTextLength methods.

Symptom

Microsoft received reports about .NET Framework May cumulative update causing customers to observe runtime exceptions in certain SQL CLR hosted scenarios. These exceptions will manifest with the error message

System.Security.HostProtectionException: Attempted to perform an operation that was forbidden by the CLR host and will contain one of the following frames in the exception stack trace:

System.Security.Cryptography.SHA256Managed..ctor()
- or -

System.Security.Cryptography.SHA384Managed..ctor()
- or -

System.Security.Cryptography.SHA512Managed..ctor()

This exception is due to a recent change in the implementation of the SHA256Managed, SHA384Managed, and SHA512Managed types in .NET Framework.  Use of the SHA1Managed, HMACSHA1, HMACSHA256, HMACSHA284, and HMACSHA512 types within SQL CLR hosted environments is not impacted.

Workaround

Multiple work arounds options are available.

One option is to mark the assembly which utilizes the SHA256Managed, SHA384Managed, or SHA512Managed types as UNSAFE. This will cause the SQL CLR hosted environment to allow the affected constructors to execute successfully.

Another option is to utilize SQL's built-in HASHBYTES function rather than the .NET Framework's SHA-2 family of APIs. The HASHBYTES function is directly callable from SQL and does not require writing managed code.

Resolution

Microsoft has resolved this issue with update KB5043803.

Release Channel

Available

Next Step

Windows Update and Microsoft Update

Yes

None. This update will be downloaded and installed automatically from Windows Update.

Windows Update for Business

Yes

None. This update will be downloaded and installed automatically from Windows Update.

Microsoft Update Catalog

Yes

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Windows Server Update Services (WSUS)

Yes

This update will automatically sync with WSUS if you configure as follows:

Product: Windows 10, version 1607 and Windows Server 2016

Classification: Updates