First Patch Tuesday in 2021 – here’s what’s new for Windows 10

Microsoft today released its first in 2021 patch set for supported Windows versions. Here are the updates released for Windows 10.

The released patches are:

• KB4598242 (OS Builds 19041.746 and 19042.746) for Windows 10 version 20H2/2004
• KB4598229 (OS Build 18363.1316) for Windows 10, version 1909
• KB4598230 (OS Build 17763.1697) for Windows 10 version 1809
• KB4598245 (OS Build 17134.1967) for Windows 10 version 1803
• KB4599208 (OS Build 15063.2614) for Windows 10 version 1703
• KB4598243 (OS Build 14393.4169) for Windows 10 version 1607
• KB4598231 (OS Build 10240.18818) for Windows 10, initial release

Here are some changes in these releases.

Changes

KB4598242 (OS Builds 19041.746 and 19042.746), KB4598229 (OS Build 18363.1316), KB4598229 (OS Build 18363.1316) share the following change log.

• Addresses a security vulnerability issue with HTTPS-based intranet servers. After installing this update, HTTPS-based intranet servers cannot, by default, use a user proxy to detect updates. Scans using these servers will fail if you have not configured a system proxy on the clients. If you must use a user proxy, you must configure the behavior using the policy “Allow user proxy to be used as a fallback if detection using system proxy fails.” To ensure the highest levels of security, also use Windows Server Update Services (WSUS) Transport Layer Security (TLS) certificate pinning on all devices. This change does not affect customers who are using HTTP WSUS servers. For more information, see Changes to scans, improved security for Windows devices.
• Addresses a security bypass vulnerability that exists in the way the Printer Remote Procedure Call (RPC) binding handles authentication for the remote Winspool interface. For more information, see KB4599464.
• Security updates to Windows App Platform and Frameworks, Windows Media, Windows Fundamentals, Windows Kernel, Windows Cryptography, Windows Virtualization, Windows Peripherals, and Windows Hybrid Storage Services.

KB4598230 (OS Build 17763.1697) comes with the following changes.

• Addresses a timing issue on print servers that might send print jobs to the wrong print queue.
• Addresses a security vulnerability issue with HTTPS-based intranet servers. After installing this update, HTTPS-based intranet servers cannot, by default, use a user proxy to detect updates. Scans using these servers will fail if you have not configured a system proxy on the clients. If you must use a user proxy, you must configure the behavior using the policy “Allow user proxy to be used as a fallback if detection using system proxy fails.” To ensure the highest levels of security, also use Windows Server Update Services (WSUS) Transport Layer Security (TLS) certificate pinning on all devices. This change does not affect customers who are using HTTP WSUS servers. For more information, see Changes to scans, improved security for Windows devices.
• Addresses a security bypass vulnerability that exists in the way the Printer Remote Procedure Call (RPC) binding handles authentication for the remote Winspool interface. For more information, see KB4599464.
• Addresses an issue that might damage the file system of some devices and prevent them from starting up after running chkdsk /f.
• Security updates to Windows App Platform and Frameworks, Microsoft Graphics Component, Windows Media, Windows Fundamentals, Windows Kernel, Windows Cryptography, Windows Virtualization, Windows Peripherals, and Windows Hybrid Storage Services.

KB4598245 (OS Build 17134.1967) comes with the following fixes and improvements.

• Extends Microsoft Defender for Endpoint support to new regions.
• Addresses a security vulnerability issue with HTTPS-based intranet servers. After installing this update, HTTPS-based intranet servers cannot, by default, use a user proxy to detect updates. Scans using these servers will fail if you have not configured a system proxy on the clients. If you must use a user proxy, you must configure the behavior using the policy “Allow user proxy to be used as a fallback if detection using system proxy fails.” To ensure the highest levels of security, also use Windows Server Update Services (WSUS) Transport Layer Security (TLS) certificate pinning on all devices. This change does not affect customers who are using HTTP WSUS servers. For more information, see Changes to scans, improved security for Windows devices.
• Addresses a security bypass vulnerability that exists in the way the Printer Remote Procedure Call (RPC) binding handles authentication for the remote Winspool interface. For more information, see KB4599464.
• Security updates to Windows App Platform and Frameworks, Microsoft Graphics Component, Windows Media, Windows Fundamentals, Windows Kernel, Windows Cryptography, Windows Virtualization, Windows Peripherals, and Windows Hybrid Storage Services.

Finally, KB4598231 (OS Build 10240.18818) comes with this change log:

• Addresses a security vulnerability issue with HTTPS-based intranet servers. After installing this update, HTTPS-based intranet servers cannot, by default, use a user proxy to detect updates. Scans using these servers will fail if you have not configured a system proxy on the clients. If you must use a user proxy, you must configure the behavior using the policy “Allow user proxy to be used as a fallback if detection using system proxy fails.” To ensure the highest levels of security, also use Windows Server Update Services (WSUS) Transport Layer Security (TLS) certificate pinning on all devices. This change does not affect customers who are using HTTP WSUS servers. For more information, see Changes to scans, improved security for Windows devices.
• Addresses a security bypass vulnerability that exists in the way the Printer Remote Procedure Call (RPC) binding handles authentication for the remote Winspool interface. For more information, see KB4599464.
• Security updates to Windows App Platform and Frameworks, Microsoft Graphics Component, Windows Media, Windows Management, Windows Fundamentals, Windows Cryptography, Windows Virtualization, Windows Peripherals, and Windows Hybrid Storage Services.

Check out the Windows Update History web site to see prerequisites for the packages, and read about known issues (if any).

How to install the updates

To download these updates, open Settings - > Update & recovery and click on the Check for Updates button on the right.

Alternatively, you can get it from the Windows Update online catalog.

Helpful links

• Find Which Windows 10 edition you have installed
• How to find the Windows 10 version you are running
• How to find the Windows 10 build number you are running
• How to install CAB and MSU updates in Windows 10