Skip to content

Commit 2aa2665

Browse files
dpaulson45dpaulson45
authored
Merge pull request #2485 from microsoft/dpaul-Dec25SU
Dec 2025 Security Update
2 parents 701e7ec + 2a3b7e2 commit 2aa2665

5 files changed

Lines changed: 20 additions & 14 deletions

File tree

‎Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCveCheck.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ function Invoke-AnalyzerSecurityCveCheck {
142142
"Mar24SU" = (NewCveEntry @("CVE-2024-26198") @($ex2016, $ex2019))
143143
"Apr25HU" = (NewCveEntry @("CVE-2025-53786") @($ex2016, $ex2019))
144144
"Oct25SU" = (NewCveEntry @("CVE-2025-59249") @($ex2016, $ex2019, $exSE))
145+
"Dec25SU" = (NewCveEntry @("CVE-2025-64666", "CVE-2025-64667") @($ex2016, $ex2019, $exSE))
145146
}
146147

147148
# Need to organize the list so oldest CVEs come out first.

‎Diagnostics/HealthChecker/Tests/HealthChecker.E16.Main.Tests.ps1‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,11 +145,11 @@ Describe "Testing Health Checker by Mock Data Imports - Exchange 2016" {
145145
$cveTests.Contains("CVE-2020-1147") | Should -Be $true
146146
$cveTests.Contains("CVE-2023-36039") | Should -Be $true
147147
$cveTests.Contains("ADV24199947") | Should -Be $true
148-
$cveTests.Count | Should -Be 60
148+
$cveTests.Count | Should -Be 62
149149
$downloadDomains = GetObject "CVE-2021-1730"
150150
$downloadDomains.DownloadDomainsEnabled | Should -Be "false"
151151

152-
$Script:ActiveGrouping.Count | Should -Be 68
152+
$Script:ActiveGrouping.Count | Should -Be 70
153153
}
154154
}
155155

‎Diagnostics/HealthChecker/Tests/HealthChecker.E19.Main.Tests.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ Describe "Testing Health Checker by Mock Data Imports" {
161161
$cveTests.Contains("CVE-2023-36434") | Should -Be $true
162162
$cveTests.Contains("CVE-2023-36039") | Should -Be $true
163163
$cveTests.Contains("ADV24199947") | Should -Be $true
164-
$cveTests.Count | Should -Be 60
164+
$cveTests.Count | Should -Be 62
165165
$downloadDomains = GetObject "CVE-2021-1730"
166166
$downloadDomains.DownloadDomainsEnabled | Should -Be "False"
167167
TestObjectMatch "Extended Protection Vulnerable" "True" -WriteType "Red"

‎Shared/Get-ExchangeBuildVersionInformation.ps1‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ function Get-ExchangeBuildVersionInformation {
131131
$cuReleaseDate = "07/01/2025"
132132
$supportedBuildNumber = $true
133133
}
134-
(GetBuildVersion $exSE "RTM" -SU "Oct25SU") { $latestSUBuild = $true }
134+
(GetBuildVersion $exSE "RTM" -SU "Dec25SU") { $latestSUBuild = $true }
135135
}
136136
} elseif ($exchangeVersion.Major -eq 15 -and $exchangeVersion.Minor -eq 2) {
137137
Write-Verbose "Exchange 2019 is detected"
@@ -150,14 +150,14 @@ function Get-ExchangeBuildVersionInformation {
150150
$cuReleaseDate = "02/10/2025"
151151
$supportedBuildNumber = $true
152152
}
153-
(GetBuildVersion $ex19 "CU15" -SU "Oct25SU") { $latestSUBuild = $true }
153+
(GetBuildVersion $ex19 "CU15" -SU "Dec25SU") { $latestSUBuild = $true }
154154
{ $_ -lt (GetBuildVersion $ex19 "CU15") } {
155155
$cuLevel = "CU14"
156156
$cuReleaseDate = "02/13/2024"
157157
$supportedBuildNumber = $true
158158
$orgValue = 16762
159159
}
160-
(GetBuildVersion $ex19 "CU14" -SU "Oct25SU") { $latestSUBuild = $true }
160+
(GetBuildVersion $ex19 "CU14" -SU "Dec25SU") { $latestSUBuild = $true }
161161
{ $_ -lt (GetBuildVersion $ex19 "CU14") } {
162162
$cuLevel = "CU13"
163163
$cuReleaseDate = "05/03/2023"
@@ -254,7 +254,7 @@ function Get-ExchangeBuildVersionInformation {
254254
$cuReleaseDate = "04/20/2022"
255255
$supportedBuildNumber = $true
256256
}
257-
(GetBuildVersion $ex16 "CU23" -SU "Oct25SU") { $latestSUBuild = $true }
257+
(GetBuildVersion $ex16 "CU23" -SU "Dec25SU") { $latestSUBuild = $true }
258258
{ $_ -lt (GetBuildVersion $ex16 "CU23") } {
259259
$cuLevel = "CU22"
260260
$cuReleaseDate = "09/28/2021"
@@ -747,6 +747,7 @@ function GetExchangeBuildDictionary {
747747
"Aug25SU" = "15.1.2507.58"
748748
"Sep25HU" = "15.1.2507.59"
749749
"Oct25SU" = "15.1.2507.61"
750+
"Dec25SU" = "15.1.2507.63"
750751
})
751752
}
752753
"Exchange2019" = @{
@@ -859,20 +860,23 @@ function GetExchangeBuildDictionary {
859860
"Aug25SU" = "15.2.1544.33"
860861
"Sep25HU" = "15.2.1544.34"
861862
"Oct25SU" = "15.2.1544.36"
863+
"Dec25SU" = "15.2.1544.37"
862864
})
863865
"CU15" = (NewCUAndSUObject "15.2.1748.10" @{
864866
"Apr25HU" = "15.2.1748.24"
865867
"May25HU" = "15.2.1748.26"
866868
"Aug25SU" = "15.2.1748.36"
867869
"Sep25HU" = "15.2.1748.37"
868870
"Oct25SU" = "15.2.1748.39"
871+
"Dec25SU" = "15.2.1748.42"
869872
})
870873
}
871874
"ExchangeSE" = @{
872875
"RTM" = (NewCUAndSUObject "15.2.2562.17" @{
873876
"Aug25SU" = "15.2.2562.20"
874877
"Sep25HU" = "15.2.2562.27"
875878
"Oct25SU" = "15.2.2562.29"
879+
"Dec25SU" = "15.2.2562.35"
876880
})
877881
}
878882
}

‎Shared/Tests/Get-ExchangeBuildVersionInformation.Tests.ps1‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ BeforeAll {
1414
param(
1515
[Parameter(Mandatory = $true)]
1616
[string]$ResultsKeyName,
17-
[bool]$ProcessLatestCUOnly = $false
17+
[bool]$ProcessLatestCUOnly = $false,
18+
[bool]$ExchangeVersionSupported = $true
1819
)
1920
$exchangeLatestCUs = $Script:results[$ResultsKeyName]
2021

@@ -26,7 +27,7 @@ BeforeAll {
2627
$latestCU.Supported | Should -Be $true
2728

2829
if ($noSUsYet) {
29-
$latestCU.LatestSU | Should -Be $true
30+
$latestCU.LatestSU | Should -Be $ExchangeVersionSupported
3031
} else {
3132

3233
$allSUsOnLatestCU = (GetExchangeBuildDictionary)[$ResultsKeyName][$latestCU.CU].SU.Values |
@@ -48,7 +49,7 @@ BeforeAll {
4849

4950
# Latest SU release should always be secure and supported
5051
$latestSU.Supported | Should -Be $true
51-
$latestSU.LatestSU | Should -Be $true
52+
$latestSU.LatestSU | Should -Be $ExchangeVersionSupported
5253

5354
# Walk through the SUs, make sure that they are set correctly.
5455
# Latest Release should be always secure, the previous one just depends on the more recent release.
@@ -69,7 +70,7 @@ BeforeAll {
6970
$currentSUTest.Supported | Should -Be $true # Still supported, just might not be secure.
7071

7172
if (-not $processedSUAlready) {
72-
$currentSUTest.LatestSU | Should -Be $true
73+
$currentSUTest.LatestSU | Should -Be $ExchangeVersionSupported
7374

7475
if ($notSecondVersionSU) {
7576
# Once we hit a SU, processedSUAlready will be set to true, causing all remaining SUs to test false for LatestSU
@@ -101,7 +102,7 @@ BeforeAll {
101102
$currentSUTest.Supported | Should -Be $true # Still supported, just might not be secure.
102103

103104
if (-not $processedSUAlready) {
104-
$currentSUTest.LatestSU | Should -Be $true
105+
$currentSUTest.LatestSU | Should -Be $ExchangeVersionSupported
105106

106107
if ($notSecondVersionSU) {
107108
# Once we hit a SU, processedSUAlready will be set to true, causing all remaining SUs to test false for LatestSU
@@ -285,10 +286,10 @@ Describe "Testing Get-ExchangeBuildVersionInformation.ps1" {
285286
Invoke-ProcessSUProcess -ResultsKeyName "ExchangeSE"
286287
}
287288
It "Exchange 2019 SU testing" {
288-
Invoke-ProcessSUProcess -ResultsKeyName "Exchange2019"
289+
Invoke-ProcessSUProcess -ResultsKeyName "Exchange2019" -ExchangeVersionSupported $true #This gets set to false once ESU is no longer a thing
289290
}
290291
It "Exchange 2016 Latest SU" {
291-
Invoke-ProcessSUProcess -ResultsKeyName "Exchange2019" -ProcessLatestCUOnly $true
292+
Invoke-ProcessSUProcess -ResultsKeyName "Exchange2016" -ProcessLatestCUOnly $true -ExchangeVersionSupported $true #This gets set to false once ESU is no longer a thing
292293
}
293294
}
294295
}

0 commit comments

Comments
 (0)