Gloridel Morales

This month, we are releasing fixes that impact our self-hosted product, Azure DevOps Server.

The following versions of the products have been patched. Check out the links for each version for more details.

Azure DevOps Server 2022.0.1 Patch 1

If you have Azure DevOps Server 2022.0.1, you should install Azure DevOps Server 2022.0.1 Patch 1.

Release notes

  • CVE-2023-21565 – Azure DevOps Server Spoofing Vulnerability.

  • CVE-2023-21569 – Azure DevOps Server Spoofing Vulnerability.

  • Fixed a bug that interfered with pushing packages when upgrading from Team Foundation Server 2018 or earlier.

  • Fixed a bug where detach or attach collection fails reporting the following error: ‘TF246018: The database operation exceeded the timeout limit and has been cancelled.

Verifying Installation

  • Run devops2022.0.1patch1.exe CheckInstall, devops2022.0.1patch1.exe is the file that is downloaded from the link above. The output of the command will either say that the patch has been installed, or that it is not installed.

Azure DevOps Server 2022 Patch 4

If you have Azure DevOps Server 2022, you should install Azure DevOps Server 2022 Patch 4.

Note: This will be the last patch for Azure DevOps Server 2022. Going forward, you should first update to Azure DevOps Server 2022.0.1 and then install the latest patches.

Release notes

  • CVE-2023-21565 – Azure DevOps Server Spoofing Vulnerability.

  • CVE-2023-21569 – Azure DevOps Server Spoofing Vulnerability.

  • Fixed a bug with service connections editor. Now draft endpoint state flushes on component dismiss.

  • Fixed a bug where detach or attach collection fails reporting the following error: ‘TF246018: The database operation exceeded the timeout limit and has been cancelled.

Verifying Installation

  • Run devops2022patch4.exe CheckInstall, devops2022patch4.exe is the file that is downloaded from the link above. The output of the command will either say that the patch has been installed, or that it is not installed.

Azure DevOps Server 2020.1.2 Patch 6

If you have Azure DevOps Server 2020.1.1, you should first update to Azure DevOps Server 2020.1.2. Once on 2020.1.2, install Azure DevOps Server 2020.1.2 Patch 6.

Release notes

  • CVE-2023-21565 – Azure DevOps Server Spoofing Vulnerability.

  • CVE-2023-21569 – Azure DevOps Server Spoofing Vulnerability.

  • Fixed a bug that interfered with pushing packages when upgrading from 2018 or earlier.

  • Fixed a bug where detach or attach collection fails reporting the following error: ‘TF246018: The database operation exceeded the timeout limit and has been cancelled.

Verifying Installation

  • Run devops2020.1.2patch6.exe CheckInstall, devops2020.1.2patch6.exe is the file that is downloaded from the link above. The output of the command will either say that the patch has been installed, or that it is not installed.

Azure DevOps Server 2020.0.2 Patch 2

If you have Azure DevOps Server 2020.0.1, you should first update to Azure DevOps Server 2020.0.2. Once on Update 2020.0.2, install Azure DevOps Server 2020.0.2 Patch 2.

Release notes

  • Fixed a bug that interfered with pushing packages when upgrading from 2018 or earlier.

Verifying Installation

  • Run devops2020.0.2patch2.exe CheckInstall, devops2020.0.2patch2.exe is the file that is downloaded from the link above. The output of the command will either say that the patch has been installed, or that it is not installed.

Azure DevOps Server 2019.1.2 Patch 3

If you have Azure DevOps Server 2019.1.1, you should first update to Azure DevOps Server 2019.1.2. Once on Update 2019.1.2, install Azure DevOps Server 2019.1.2 Patch 3.

Release notes

  • Fixed a bug that interfered with pushing packages when upgrading from 2018 or earlier.

Verifying Installation

  • Run devops2019.1.2patch3.exe CheckInstall, devops2019.1.2patch3.exe is the file that is downloaded from the link above. The output of the command will either say that the patch has been installed, or that it is not installed.