Release Update 19.33
This page describes the features and behavior changes that are new in Release Update 19.33.
New Features
Update the Oracle Wallet Created by the Cloud Backup Module Installer
The cloud backup module installers for OCI, OCI Classic, and Microsoft Azure now support the -updateWalletNoValidate parameter, which updates the cloud storage account credentials stored in the Oracle wallet.
If you change your cloud storage account credentials, update the existing Oracle wallet by rerunning the installer with the wallet directory location along with -updateWalletNoValidate. The installer updates the wallet without validating the host connection. Ensure that the host and bucket identify the intended cloud storage target.
You can update the Oracle wallet without requiring a successful connection to the target host, which helps avoid connection-validation failures.
Behavior Changes
Release Update 19.33 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.
CREATE INDEX Requires VPD Bypass Authorization for Protected UDF Arguments
Behavior change: Oracle Database rejects a supported functional-index CREATE INDEX statement when its user-defined function (UDF) arguments are protected by VPD and lack bypass authorization. Affected administrators can use the existing VPD bypass privilege or revise the index expression to create the index.
This change enforces the required VPD bypass authorization when you create a functional index.
Mandatory Unified Auditing of Direct SYS DML on Audit Trail Tables
Behavior change: Supported direct DML operations by SYS on SYS.AUD$ and SYS.FGA_LOG$ generate ORA$MANDATORY unified audit records.
This change enables security administrators to detect direct changes to traditional and fine-grained audit trail data in the UNIFIED_AUDIT_TRAIL view.
New Permission Requirements for Oracle ASM File Group Operations
Behavior change: Moving a file group to a new quota group now requires only the SYSASM privilege. File group template usage now requires an Oracle ASM File Access Control check. Moving a file between file groups now requires an Oracle ASM File Access Control check.
The new permission requirements provide enhanced security, as well as quota management.
Secure Authentication for Persistent RMAN Channel Configuration
Behavior change: You must now use a secure external authentication method, such as Oracle wallets or secure external password store for configuring a persistent channel because RMAN does not allow passwords in the connection string of the CONFIGURE CHANNEL command.
Using a secure external authentication method enhances security and reduces the risk of passwords being exposed in the control file as part of RMAN persistent channel configuration.
SYS.KUBSAGT Requires Explicit EXECUTE Privilege
Behavior change: Public access to the SYS.KUBSAGT PL/SQL package has been removed as part of a security-related behavior change. Hadoop cluster database users that require this package must be granted the EXECUTE privilege explicitly; otherwise, dependent Hadoop operations may fail with insufficient-privilege or package-access errors. A database administrator can grant the privilege by running GRANT EXECUTE ON SYS.KUBSAGT TO <HADOOP_USER>;.
Restricting access to explicitly authorized users improves database security and provides administrators with finer-grained control over access to SYS.KUBSAGT and related Hadoop operations.
Unified Auditing Mandatory Auditing for SYS Authorization Metadata
Behavior change: Unified Auditing now writes ORA$MANDATORY audit records for direct INSERT, UPDATE, and DELETE operations on SYS.OBJAUTH$, SYS.CODEAUTH$, SYS.USERAUTH$, SYS.CDB_LOCAL_ADMINAUTH$, and SYS.ADMINAUTH$.
This change strengthens audit coverage of authorization and privilege metadata changes, enabling security administrators to detect direct changes to these sensitive dictionary tables in the Unified Audit Trail.