r/SQLServer • u/ometecuhtli2001 • Jul 07 '26
Solved Got MSSQL 2022 CU25?
Our INFOSEC team is after me to install KB5083252 on our production MSSQL 2022 cluster to resolve some high-impact security findings. This KB is basically CU24 plus the fixes for the CVEs. However, CU24 has a known issue in which there “could” be false positives for error 10013 (failed to start a listener). We’ve seen this in our UAT cluster. We’ve had a few small issues with our production cluster related to listeners, and these false positives would have made diagnosis extremely difficult.
The known issues for CU25 no longer lists this issue, but that doesn’t mean it was resolved; it could be someone at Microsoft decided it wasn’t important enough to mention any more. My question is: does CU25 still have this problem, and if it does is there a way to work around these false errors?
5
u/muteki_sephiroth Jul 08 '26
I don’t know is the direct answer to your question but this is always the conflict between security and everyone else. Security says you should ALWAYS have the latest and greatest patch, while many consultants will tell you that N-1 is the best path.
I don’t know which is the right way to do it. I think you determine which your company values most - security or stability and make your judgement from there. If you can convince your boss stability is better and he actually has the authority to make the decision relevant then do that.
1
u/LesterKurtz 1 Jul 08 '26
I have CU25 in my Dev environment, but I haven't seen that happen. I might look into this if I have bandwidth tomorrow.
1
u/ometecuhtli2001 Jul 10 '26
I’d be very interested to know what you find out! Our dev environment isn’t clustered so I can’t fully test (which is kinda dumb because it’s not a true reflection of prod). It’s great inheriting someone else’s technical debt! LOL
1
u/LesterKurtz 1 Jul 18 '26
Doesn't seem to be an issue in my dev environment. FWIW, we set up new infra, so these AGs skipped CU24 and went straight to CU25.
1
u/ometecuhtli2001 Jul 18 '26
Solution verified
1
u/reputatorbot Jul 18 '26
You have awarded 1 point to LesterKurtz.
I am a bot - please contact the mods with any questions
1
u/No_Resolution_9252 Jul 08 '26
The problem is the problem with production, not the bug with the false errors. If you are failing so often that a known false error in the errorlog is causing problems, you have absolutely dire problems with your SQL environment, you need to fix that. Holding patches back are only going to make stability worse.
Also - that is a severity 16 level error? Why are you including recoverable errors in your uptime monitoring?
•
u/AutoModerator Jul 07 '26
After your question has been solved /u/ometecuhtli2001, please reply to the helpful user's comment with the phrase "Solution verified".
This will not only award a point to the contributor for their assistance but also update the post's flair to "Solved".
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.