I understand October 2020 Oracle patches included security updates for Oracle Data Integrator (ODI) version

The application admin who is managing ODI for us is really new and used to be with Windows desktop support. He is willing to help but needs guidance on what to look for.

  1. How can we determine if the Oracle Data Integrator version we are running is vulnerable to CVE 2020-5398 or not? The application admin ran a Qualys scan and it did not detect vulnerability for CVE 2020-5398 but an auditor is going to be visiting us soon so we need another confirmation that we are not impacted for CVE 2020-5398. The application admin asked people he knew and did not hear that anyone was using Spring framework whose vulnerability is fixed in CVE 2020-5398 and did not hear anything but since he is new, he is not sure if CVE 2020-5398 affects us or not.

  2. Is there any tool/script by Oracle by which we can definitively know what vulnerabilities affect us for the Oracle Data Integrator version

3.How can we ensure that we are patched for Oracle released updates and did not miss anything? We use Qualys application to scan our systems for vulnerabilities but our auditor needs a second confirmation.

  • 1
    does it really matter, ypou would install all patches that come, and one is still not fixed, what can you do.
    – nbk
    Commented Nov 29, 2020 at 15:06

1 Answer 1


Logon to My Oracle Support and search for "CVE 2020-5398". I just did that and there are many hits listing patches that address this.

But let's suppose a hypothetical question. Suppose the vulnerability is not fixed by any available patch. What is your next course of action?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.