Security

Are there security fixes included? Which CVEs?

Posted on September 22, 2026 by Patch Recommendation Release Schedule Security 6

I received multiple questions from colleagues and customers over the past weeks regarding the security content in RUs and MRPs. See also my blog post from yesterday where I touched this topic briefly. The question regarding RUs, MRPS and CSPUs often is: Are there security fixes included? Which CVEs?

Are there security fixes included? Which CVEs?

Photo by Gene Gallin on Unsplash

Release Updates are the primary vehicle

As I explained already, Release Updates (RU) are the primary and main vehicle to deliver security fixes. MRPs and CSPUs contain only a smaller portion, usually those fixes with really high CVE scores which can’t wait until …

Continue reading...

Patch your databases against AI-enabled cybersecurity threats

Posted on May 4, 2026 by Oracle AI Database 26ai Oracle Database 19c Patch Recommendation Security 35

I guess you all read the announcements and predictions over the past weeks. New AI models and improvements to existing models may allow to find security issues in existing software much quicker. While this sounds alarming on one side (yes, it does), it also enables software vendors to secure their software. But in order to benefit from it, you must patch your databases against AI-enabled cybersecurity threats.

Patch your databases against AI-enabled cybersecurity threats

Photo by Scott Webb on Unsplash

Read the official announcements

At first, please read the official announcements released here:

… Continue reading...

Download and use the Oracle Database Security Assessment Tool

Posted on September 18, 2017 by Security 11

I visit customers on a regular basis. And when we sit together in front of the machine I sometimes spot tiny little things which may impose a security risk. This could be things such as SEC_CASE_SENSITIVE_LOGON=FALSE or the use of UTL_FILE_DIR or something else. To detect such sensitive spots you should download and use the Oracle Database Security Assessment Tool (DBSAT).

CREATE SESSION SELECT on SYS.REGISTRY$HISTORY Role SELECT_CATALOG_ROLE Role DV_SECANALYST (wenn Database Vault aktiviert ist) Role AUDIT_VIEWER (nur 12c) Role CAPTURE_ADMIN (nur 12c) SELECT on SYS.DBA_USERS_WITH_DEFPWD (11g und 12c) SELECT on AUDSYS.AUD$UNIFIED (nur 12c)

DBSAT – Oracle Database Security Assessment Tool – Collector and Reporter Components

Download and use the Oracle Database Security Assessment Tool

First of all, you need to download the tool from MyOracle Support:

… Continue reading...

What happens to PASSWORD_VERSIONS during an upgrade to Oracle 12.2?

Posted on April 25, 2017 by Oracle Database 12.2.0.1 Security 27

I did blog a day ago about ORA-1017 connection issues in Oracle Database 12.2 once you would like to use the deprecated init.ora/spfile parameter SEC_CASE_SENSITIVE_LOGON=FALSE:

Having some fun with SEC_CASE_SENSITIVE_LOGON and ORA-1017

But how can this change actually happen?

Let’s check how the PASSWORD_VERSIONS is set in a fresh Oracle Database 12.1.0.2 database with the January 2017 Proactive Bundle Patch applied to it:

SQL> select username, password_versions from dba_users order by 1;

USERNAME		       PASSWORD_VERSIONS
------------------------------ -----------------
ANONYMOUS
APPQOSSYS		       10G 11G 12C
AUDSYS			       10G 11G 12C
DBSNMP			       10G 11G 12C
DIP			       10G 11G 12C
GSMADMIN_INTERNAL	       10G 11G 12C
GSMCATUSER		       10G
… Continue reading...

Having some fun with SEC_CASE_SENSITIVE_LOGON and ORA-1017

Posted on April 24, 2017 by Behavior Change Oracle Database 12.2.0.1 Security 24

The init.ora/spfile parameter SEC_CASE_SENSITIVE_LOGON got deprecated since Oracle Database 12.1.0.1. This means, we don’t do any further developments to it, you shouldn’t change it from its default TRUE – and if you still do you’ll receive a nice warning during STARTUP of your database:

SQL> alter system set sec_case_sensitive_logon=false scope=spfile;

System altered.

SQL> startup force
ORA-32004: obsolete or deprecated parameter(s) specified for RDBMS instance
ORACLE instance started.

Recently a customer asked me if we’d changed the behavior of this parameter in Oracle Database 12c Release 2 as he receives now an ORA-1017: Invalid username or password error when …

Continue reading...

Unified Auditing – Performance Improvements in Oracle 12.1.0.2

Posted on April 19, 2017 by Auditing Performance Tuning Security 14

Unified Auditing got introduced in Oracle Database 12.1.

Unified Auditing - Performance Improvements in Oracle 12.1The downsides of the “old” auditing facilities became obvious when too many users had activities or transactions at the same time leading to audit records being written into AUD$. Contention was a typical issue. The same thing happened when too many users tried to login at the same time. Furthermore protecting the auditing information required Database Vault as there was no default protection available.

This – and some other things – should be remedied by Unified Auditing which is available since Oracle Database 12c. It gets enabled in sort of a “mixed …

Continue reading...

Oracle 12.1.0.2 – Security Behavior Change with non-SYSDBA Triggers

Posted on May 26, 2015 by Behavior Change Flaws and Pitfalls Oracle Database 12c Security 6

Oracle Database SecuritySometimes things get revealed at unexpected occasions. This one happened during a recent customer upgrade to Oracle Database 12c with a 3rd party geospatioanl application installed (ESRI).

At the very end of the upgrade the customer saw many ORA-1031 (insufficient privileges) errors and it seemed to be that nothing was working correctly anymore.

This happened during the run of catupend.sql. The following code path in  catupend.sql causes the error.

cursor ddl_triggers
is
select o.object_id from dba_triggers t, dba_objects o
where t.owner = o.owner and t.trigger_name = o.object_name and o.object_type = 'TRIGGER'
and (t.triggering_event like '%ALTER%' or t.triggering_event like '%DDL%');
… Continue reading...

New Behaviour in Oracle Database 12c and 11.2.0.4: SELECT ANY DICTIONARY with reduced privilege set

Posted on March 2, 2015 by Behavior Change Oracle Database 12c Security 5

You’ve just upgraded to Oracle Database 12c – but your favorite admin tool receives an ORA-1031: Insufficient Privileges after connection?

Then the reason may be the reduced set of privileges for the SELECT ANY DICTIONARY privilege. This privilege does not allow access to tables USER$, ENC$ and DEFAULT_PWD$, LINK$, USER_HISTORY$, CDB_LOCAL_ADMINAUTH$, and XS$VERIFIERS. Actually such changes are not new. For instance in Oracle 10.1 we removed the access to  LINK$ in SELECT ANY DICTIONARY (well, this may have happened because the dblink’s password was stored in clear text in LINK$ – a misbehavior which is fixed since …

Continue reading...
Mike Dietrich
Oracle Vice President of Product Management and Development for Database Upgrade, Cloud Migrations and Patching writing just another blog.

Opinions certainly are my own as is this page.

Archives

Categories

Upgrade @YouTube

Subscribe via Email

Join 11.3K other subscribers