0

I've applied the latest Oracle 12c Database Proactive Bundle Patch (DBBP).

My security team runs scans and April 2015 CPU (amongst other CPUs) continues to show up as vulnerabilities.

I need to prove that DBBP is a cumulative patch and all those old vulnerabilities are fixed.

sys.registry$history doesn't help

select ACTION,NAMESPACE,COMMENTS from registry$history;
ACTION                    NAMESPACE    VERSION     COMMENTS
------------------------- ------------ ------------------------
UPGRADE                   SERVER        12.2.0.1.0 Upgraded from 12.1.0.2.0

opatch lsinventory -bugs_fixed or opatch lsinventory -details isn't giving me what I want.

How can I find out what vulnerabilities are in April 2015 CPU and prove that DBBP has mitigated them???

Improve this question
1
  • Actually there are times that you can not, I have applied latest patches available and have given them (security team) the logs that show that the patch was installed and was successful. Might be something with DPBP or the security suit being ran. BTW I am lucky enough to only deal with 1 oracle system now and that is the only one being flagged. If your software vendor is using Symantec for the patches, that can be an issue as well, but as it sounds, it is not.
    – jstexasdba
    Jul 25, 2017 at 23:42

1 Answer 1

Reset to default
0

The key word you're looking for is "cumulative".

Note 1962125.1 (Oracle Database - Overview of Database Patch Delivery Methods), includes this text about Bundle Patches:

Bundle Patch (BP)
- a cumulative collection of fixes to address bugs in a given feature, product, or configuration
     For example: Windows Database Bundle Patch, Database Patch for Exadata, Database Proactive Bundle Patch
- a superset of PSU

So that's all you should need to provide! BPs include all patches previously included in earlier BPs/PSUs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.