.NET Security Update

We got this message days ago. I went ahead and installed it and alerted our network/server guru that this ought to be rolled out to servers/workstations.

After doing some investigation, on 4/22/2022 Microsoft had issued an announcement that .Net 4.8 has security vulnerabilities and listed all the platforms it needs to be updated and wow, it was a lot!

I recommend searching for yourself, and doing an update to get OFF OF 4.8 and onto 6.0 or greater. Not only for performance, but for security.

2 Likes

The Microsoft .NET 4.8 Framework is a different product than .NET 6. As many applications - including Microsoft Apps - are written for the .NET Framework, everyone should be diligent about keeping .NET 4.8 up-to-date with all the latest MS Updates.

The .NET 4.8 Framework is on Long Term Support with Microsoft meaning that it will receive Security patches as necessary and no end date for that support has been published.

The Kinetic Server prior to the 2022.1 release and all versions of the Kinetic Smart Client require the .NET 4.8 Framework.

6 Likes

For those looking for the detail. :slight_smile:

I believe this is what you are referring to?

.NET Framework April 2022 Security and Quality Rollup Updates - .NET Blog (microsoft.com)

@aberdeenmeadows major version numbers typically indicate framework or feature updates. Any software company worth their salt will have a long term support program that security issues are address in old and new versions as patches or hotfixes.

4.8 will be required for a lot of existing software (Kinetic included until 2022 release) removing 4.8 will likely break a good handful of software packages and any reinstall will go to Microsoft and install it again.

1 Like

Since we are dedicated cloud tenancy, how much of this do we need to worry about? We don’t maintain any part of the servers ourselves. At least as far as I know. Is this something our MSP should look at for us?

As @Olga mentioned in another post, the .NET client will always use the .NET Framework (4.8). Yes, Epicor will patch the servers. Regardless of the system, you should ALWAYS patch your endpoints. If your MSP patches your local endpoints, then you’re good. IMHO, even if someone else is doing it, it’s always good to check the dashboard to make sure your systems are up-to-date.

2 Likes

Great advice! Which dashboard can I see that information in?

Depends on your patching system. WSUS (Windows Update Service) has one and most enterprise Anti-Malware systems (MS Endpoint Protection, ESET, BitDefender, etc.) will as well.

Interesting. We are Public Cloud and I get this warning when opening the Function Designer in our Pilot Environment…
image

Don’t get the warning in Production. We have a data provider and they say they installed and we still get the error in Pilot , not production. All on same server with provider.

Epicor problem ??

I also get this warning in Method Directive when opening the Design window.

Any other cloud customer getting the same warning messages ??

Dean

Yes.

Broken BPM After Upgrade (Pilot) - Kinetic 2021 - Epicor User Help Forum (epiusers.help)

Thank you Mr Wonsil,

Looks like running the language fix should resolve it ?
opps Rebuild Translation Tables

Installing the .NET 6 runtime on the workstation using the BPM Design tool will fix the problem you’re having.

I am on a RDS setup. SO… .net Runtime should be installed on RDS Server ?? Thats our Data Providers ballgame Im guessing…

Yes. Nothing is ever easy! :rofl: Ask who manages the RDS to take care of it.

1 Like

Thank you Sir !!

~WRD000.jpg

1 Like