STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Oracle database products must be a version supported by the vendor.

DISA Rule

SV-237753r667296_rule

Vulnerability Number

V-237753

Group Title

SRG-APP-000456-DB-000400

Rule Version

O112-BP-024750

Severity

CAT II

CCI(s)

CCI-002605 - The organization installs security-relevant software updates within an organization-defined time period of the release of the updates.

Weight

Fix Recommendation

Remove or decommission or all unsupported software products.

Upgrade unsupported DBMS or unsupported components to a supported version of the product.

Oracle recommends the following upgrade options:

For product longevity and patching, Oracle strongly recommends upgrading to19c which is the Long Term Release with a support end date of April 30, 2027 (or April 30, 2024 if you choose not to pay Extended Support fees or purchase a ULA).
If you are currently running 11.2.x you will need to upgrade to the terminal release (11.2.0.4) for the DB Release you are running and then continue the upgrade process by upgrading to the 19c.

Check Contents

Review the system documentation and interview the database administrator.

Identify all database software components.

Review the version and release information.
From SQL*Plus:

Select version from v$instance;

Access the vendor website or use other means to verify the version is still supported.
Oracle Release schedule:
https://support.oracle.com/knowledge/Oracle%20Database%20Products/742060_1.html

If the Oracle version or any of the software components are not supported by the vendor, this is a finding.

Oracle database products must be a version supported by the vendor.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments