Monthly Patching and Weekly Security Patching

[Chuck Nusbaum]

The new weekly security patching is throwing me for a bit of a loop with respect to monthly patching. Here's the scenario.

At the beginning of August, we decided we wanted to go to Zurich Patch 11m to fix a known issue. We upgraded non-prod instances to 11m and scheduled prod to go to 11m as well at the end of the month.

In the middle of the month, weekly security patches started being deployed, and 11m was determined to be a downgrade from Patch 10 Hotfix 4 w33, so our prod update to 11m got canceled.

Today, we got notification of the October patching target: Zurich Patch 10 Hotfix 4b.

I'd like to get our instances on the same patch level again...but I suspect that if we schedule to go to Patch 12, then weekly security patches are going to determine it as a downgrade and it will be canceled again.

Shall we just give that a try or does anyone have a different/better approach?

[Chuck Nusbaum]

Apologies for not sharing the next installment of our adventure!

We were able to get our PROD instance patched to ZP12 on that Friday...before the weekly security hotfixes were released, so we weren't flagged as being behind/downgrade.

However, once we did that, weekly security hotfixes stopped being automatically applied in PROD. For two weeks our nonprod instances on ZP12 received weekly security hotfixes, but PROD was left alone. Last week, we opened a case asking: if there's a security hotfix for ZP12, why would nonprod instances receive it but our PROD instance would not? We didn't receive a clear answer early enough in the week, so we self-scheduled PROD to get the W41 security hotfix, which worked.

Now we're continuing to work the case to understand why nonprod instances would get a security hotfix and PROD would not when they are all running the same patch version.

I reread the related KBs that just got updated again yesterday. I realize they say: "Your instance may not be scheduled for every hot fix." However, I don't understand why, if a weekly security hotfix is deemed necessary and applied to nonprod instances, why it would not also be applied to PROD. That would seem to be leaving PROD vulnerable, no?