STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database software must be evaluated and patched against newly found vulnerabilities.

DISA Rule

SV-270585r1137667_rule

Vulnerability Number

V-270585

Group Title

SRG-APP-000456-DB-000390

Rule Version

O19C-00-018600

Severity

CAT I

CCI(s)

CCI-002605 - Install security-relevant software updates within an organization-defined time period of the release of the updates.

Weight

Fix Recommendation

Institute and adhere to policies and procedures to ensure that patches are consistently applied to the Oracle Database within the time allowed.

Follow the instructions provided by Oracle to download and apply the appropriate security patches.

Log on to My Oracle Support.

Select patches and download the specific patch number and corresponding sha256 checksum. Once the patch is downloaded to the server, check the sha256 checksum to make sure the patch is valid.

To check the sha256 Checksum in Linux/Unix, the command is:
$ sha256sum /home/myuser/test_file4

09b4b51a60d6913b82e3353eef179969ad0968ff8acfb37ca891f04df67b93f0 /home/myuser/test_file5

Once the checksum is validated, apply the patch:
$ cd $ORACLE_HOME
$ opatch apply

Check Contents

When the Quarterly CPU is released, check the CPU Notice and note the specific patch number for the system. Then, issue the following command:

SELECT patch_id, source_version, action, status, description from dba_registry_sqlpatch;

This will generate the patch levels for the home and any specific patches that have been applied to it.

If the currently installed patch levels are lower than the latest, this is a finding.

Vulnerability Number

V-270585

Documentable

False

Rule Version

O19C-00-018600

Severity Override Guidance

Check Content Reference

Target Key

5672