Which ASA 9.16(4)x interim is stable on ASA 5516-X hardware?

[Bernd Nies]

Hi,

We have to upgrade our 5516-X ASAs from 9.16(4)55 due to CVE-2024-20353. That one is fixed in 9.16(4)57. Which interim version of ASA 9.16(4) running on ASA 5516-X hardware multi-context active/active is stable and is actually running on production in the real world? Most likely not 9.16(4)62 which was just released yesterday. 

• https://www.cve.org/CVERecord?id=CVE-2024-20353
• https://www.cisco.com/web/software/280775065/163160/ASA-9164-Interim-Release-Notes.html
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj68783

In the past every new ASA patch release introduced new severe bugs.

I miss the ratings and comments of software versions in the Cisco software download portal.

Regards,

Bernd

[ccieexpert]

My suggestion is to go for the one before the latest... if the latest just came out... if its been out for 4-8 weeks then it is safer.. I also suggest you read the latest release notes to see if any issues that may apply to your environment that have been fixed in the latest release..

At the end of the day, each customer has unique features and environment, so generally stable does not mean, that you wont have an issue. So check release notes and some testing in a planned maintenance window will help.

Always keep the previous image ready, just incase you need to revert to that and keep backups..

[tvotna]

For us 9.16.4.57 appears to be quite stable, at least it doesn't crash. We use VPN, but in single mode and without failover.

It's not quite clear though why 9.16.4.62 was released so quickly after 9.16.4.61. Usually this indicates that previous version has serious bug in it, typically a regression. I was thinking that CSCwk02804 is the bug, but no, this appears to be a day-1 issue and a corner case. So, probably the idea was to finally fix CSCwi84314 which caused CSCwj68783, CSCwj93921 and many other issues. The new code fix is tracked under CSCwk04492 and the fix is included into the 9.16.4.62. Also, CSCwj82736 has been fixed, which is important for FTD.